2 * xt_hashlimit - Netfilter module to limit the number of packets per time
3 * separately for each hashbucket (sourceip/sourceport/dstip/dstport)
5 * (C) 2003-2004 by Harald Welte <laforge@netfilter.org>
6 * Copyright © CC Computer Consultants GmbH, 2007 - 2008
8 * Development of this code was funded by Astaro AG, http://www.astaro.com/
10 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
11 #include <linux/module.h>
12 #include <linux/spinlock.h>
13 #include <linux/random.h>
14 #include <linux/jhash.h>
15 #include <linux/slab.h>
16 #include <linux/vmalloc.h>
17 #include <linux/proc_fs.h>
18 #include <linux/seq_file.h>
19 #include <linux/list.h>
20 #include <linux/skbuff.h>
24 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
25 #include <linux/ipv6.h>
29 #include <net/net_namespace.h>
30 #include <net/netns/generic.h>
32 #include <linux/netfilter/x_tables.h>
33 #include <linux/netfilter_ipv4/ip_tables.h>
34 #include <linux/netfilter_ipv6/ip6_tables.h>
35 #include <linux/netfilter/xt_hashlimit.h>
36 #include <linux/mutex.h>
38 MODULE_LICENSE("GPL");
39 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
40 MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
41 MODULE_DESCRIPTION("Xtables: per hash-bucket rate-limit match");
42 MODULE_ALIAS("ipt_hashlimit");
43 MODULE_ALIAS("ip6t_hashlimit");
45 struct hashlimit_net
{
46 struct hlist_head htables
;
47 struct proc_dir_entry
*ipt_hashlimit
;
48 struct proc_dir_entry
*ip6t_hashlimit
;
51 static int hashlimit_net_id
;
52 static inline struct hashlimit_net
*hashlimit_pernet(struct net
*net
)
54 return net_generic(net
, hashlimit_net_id
);
57 /* need to declare this at the top */
58 static const struct file_operations dl_file_ops
;
67 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
79 /* static / read-only parts in the beginning */
80 struct hlist_node node
;
81 struct dsthash_dst dst
;
83 /* modified structure members in the end */
85 unsigned long expires
; /* precalculated expiry time */
87 unsigned long prev
; /* last modification */
89 u_int32_t credit_cap
, cost
;
94 struct xt_hashlimit_htable
{
95 struct hlist_node node
; /* global list of all htables */
100 struct hashlimit_cfg1 cfg
; /* config */
102 /* used internally */
103 spinlock_t lock
; /* lock for list_head */
104 u_int32_t rnd
; /* random seed for hash */
105 unsigned int count
; /* number entries in table */
106 struct timer_list timer
; /* timer for gc */
109 struct proc_dir_entry
*pde
;
112 struct hlist_head hash
[0]; /* hashtable itself */
115 static DEFINE_MUTEX(hashlimit_mutex
); /* protects htables list */
116 static struct kmem_cache
*hashlimit_cachep __read_mostly
;
118 static inline bool dst_cmp(const struct dsthash_ent
*ent
,
119 const struct dsthash_dst
*b
)
121 return !memcmp(&ent
->dst
, b
, sizeof(ent
->dst
));
125 hash_dst(const struct xt_hashlimit_htable
*ht
, const struct dsthash_dst
*dst
)
127 u_int32_t hash
= jhash2((const u32
*)dst
,
128 sizeof(*dst
)/sizeof(u32
),
131 * Instead of returning hash % ht->cfg.size (implying a divide)
132 * we return the high 32 bits of the (hash * ht->cfg.size) that will
133 * give results between [0 and cfg.size-1] and same hash distribution,
134 * but using a multiply, less expensive than a divide
136 return ((u64
)hash
* ht
->cfg
.size
) >> 32;
139 static struct dsthash_ent
*
140 dsthash_find(const struct xt_hashlimit_htable
*ht
,
141 const struct dsthash_dst
*dst
)
143 struct dsthash_ent
*ent
;
144 struct hlist_node
*pos
;
145 u_int32_t hash
= hash_dst(ht
, dst
);
147 if (!hlist_empty(&ht
->hash
[hash
])) {
148 hlist_for_each_entry_rcu(ent
, pos
, &ht
->hash
[hash
], node
)
149 if (dst_cmp(ent
, dst
)) {
150 spin_lock(&ent
->lock
);
157 /* allocate dsthash_ent, initialize dst, put in htable and lock it */
158 static struct dsthash_ent
*
159 dsthash_alloc_init(struct xt_hashlimit_htable
*ht
,
160 const struct dsthash_dst
*dst
, bool *race
)
162 struct dsthash_ent
*ent
;
164 spin_lock(&ht
->lock
);
166 /* Two or more packets may race to create the same entry in the
167 * hashtable, double check if this packet lost race.
169 ent
= dsthash_find(ht
, dst
);
171 spin_unlock(&ht
->lock
);
176 /* initialize hash with random val at the time we allocate
177 * the first hashtable entry */
178 if (unlikely(!ht
->rnd_initialized
)) {
179 get_random_bytes(&ht
->rnd
, sizeof(ht
->rnd
));
180 ht
->rnd_initialized
= true;
183 if (ht
->cfg
.max
&& ht
->count
>= ht
->cfg
.max
) {
184 /* FIXME: do something. question is what.. */
185 net_err_ratelimited("max count of %u reached\n", ht
->cfg
.max
);
188 ent
= kmem_cache_alloc(hashlimit_cachep
, GFP_ATOMIC
);
190 memcpy(&ent
->dst
, dst
, sizeof(ent
->dst
));
191 spin_lock_init(&ent
->lock
);
193 spin_lock(&ent
->lock
);
194 hlist_add_head_rcu(&ent
->node
, &ht
->hash
[hash_dst(ht
, dst
)]);
197 spin_unlock(&ht
->lock
);
201 static void dsthash_free_rcu(struct rcu_head
*head
)
203 struct dsthash_ent
*ent
= container_of(head
, struct dsthash_ent
, rcu
);
205 kmem_cache_free(hashlimit_cachep
, ent
);
209 dsthash_free(struct xt_hashlimit_htable
*ht
, struct dsthash_ent
*ent
)
211 hlist_del_rcu(&ent
->node
);
212 call_rcu_bh(&ent
->rcu
, dsthash_free_rcu
);
215 static void htable_gc(unsigned long htlong
);
217 static int htable_create(struct net
*net
, struct xt_hashlimit_mtinfo1
*minfo
,
220 struct hashlimit_net
*hashlimit_net
= hashlimit_pernet(net
);
221 struct xt_hashlimit_htable
*hinfo
;
225 if (minfo
->cfg
.size
) {
226 size
= minfo
->cfg
.size
;
228 size
= (totalram_pages
<< PAGE_SHIFT
) / 16384 /
229 sizeof(struct list_head
);
230 if (totalram_pages
> 1024 * 1024 * 1024 / PAGE_SIZE
)
235 /* FIXME: don't use vmalloc() here or anywhere else -HW */
236 hinfo
= vmalloc(sizeof(struct xt_hashlimit_htable
) +
237 sizeof(struct list_head
) * size
);
240 minfo
->hinfo
= hinfo
;
242 /* copy match config into hashtable config */
243 memcpy(&hinfo
->cfg
, &minfo
->cfg
, sizeof(hinfo
->cfg
));
244 hinfo
->cfg
.size
= size
;
245 if (hinfo
->cfg
.max
== 0)
246 hinfo
->cfg
.max
= 8 * hinfo
->cfg
.size
;
247 else if (hinfo
->cfg
.max
< hinfo
->cfg
.size
)
248 hinfo
->cfg
.max
= hinfo
->cfg
.size
;
250 for (i
= 0; i
< hinfo
->cfg
.size
; i
++)
251 INIT_HLIST_HEAD(&hinfo
->hash
[i
]);
255 hinfo
->family
= family
;
256 hinfo
->rnd_initialized
= false;
257 spin_lock_init(&hinfo
->lock
);
259 hinfo
->pde
= proc_create_data(minfo
->name
, 0,
260 (family
== NFPROTO_IPV4
) ?
261 hashlimit_net
->ipt_hashlimit
: hashlimit_net
->ip6t_hashlimit
,
262 &dl_file_ops
, hinfo
);
263 if (hinfo
->pde
== NULL
) {
269 setup_timer(&hinfo
->timer
, htable_gc
, (unsigned long)hinfo
);
270 hinfo
->timer
.expires
= jiffies
+ msecs_to_jiffies(hinfo
->cfg
.gc_interval
);
271 add_timer(&hinfo
->timer
);
273 hlist_add_head(&hinfo
->node
, &hashlimit_net
->htables
);
278 static bool select_all(const struct xt_hashlimit_htable
*ht
,
279 const struct dsthash_ent
*he
)
284 static bool select_gc(const struct xt_hashlimit_htable
*ht
,
285 const struct dsthash_ent
*he
)
287 return time_after_eq(jiffies
, he
->expires
);
290 static void htable_selective_cleanup(struct xt_hashlimit_htable
*ht
,
291 bool (*select
)(const struct xt_hashlimit_htable
*ht
,
292 const struct dsthash_ent
*he
))
296 /* lock hash table and iterate over it */
297 spin_lock_bh(&ht
->lock
);
298 for (i
= 0; i
< ht
->cfg
.size
; i
++) {
299 struct dsthash_ent
*dh
;
300 struct hlist_node
*pos
, *n
;
301 hlist_for_each_entry_safe(dh
, pos
, n
, &ht
->hash
[i
], node
) {
302 if ((*select
)(ht
, dh
))
303 dsthash_free(ht
, dh
);
306 spin_unlock_bh(&ht
->lock
);
309 /* hash table garbage collector, run by timer */
310 static void htable_gc(unsigned long htlong
)
312 struct xt_hashlimit_htable
*ht
= (struct xt_hashlimit_htable
*)htlong
;
314 htable_selective_cleanup(ht
, select_gc
);
316 /* re-add the timer accordingly */
317 ht
->timer
.expires
= jiffies
+ msecs_to_jiffies(ht
->cfg
.gc_interval
);
318 add_timer(&ht
->timer
);
321 static void htable_destroy(struct xt_hashlimit_htable
*hinfo
)
323 struct hashlimit_net
*hashlimit_net
= hashlimit_pernet(hinfo
->net
);
324 struct proc_dir_entry
*parent
;
326 del_timer_sync(&hinfo
->timer
);
328 if (hinfo
->family
== NFPROTO_IPV4
)
329 parent
= hashlimit_net
->ipt_hashlimit
;
331 parent
= hashlimit_net
->ip6t_hashlimit
;
334 remove_proc_entry(hinfo
->pde
->name
, parent
);
336 htable_selective_cleanup(hinfo
, select_all
);
340 static struct xt_hashlimit_htable
*htable_find_get(struct net
*net
,
344 struct hashlimit_net
*hashlimit_net
= hashlimit_pernet(net
);
345 struct xt_hashlimit_htable
*hinfo
;
346 struct hlist_node
*pos
;
348 hlist_for_each_entry(hinfo
, pos
, &hashlimit_net
->htables
, node
) {
349 if (!strcmp(name
, hinfo
->pde
->name
) &&
350 hinfo
->family
== family
) {
358 static void htable_put(struct xt_hashlimit_htable
*hinfo
)
360 mutex_lock(&hashlimit_mutex
);
361 if (--hinfo
->use
== 0) {
362 hlist_del(&hinfo
->node
);
363 htable_destroy(hinfo
);
365 mutex_unlock(&hashlimit_mutex
);
368 /* The algorithm used is the Simple Token Bucket Filter (TBF)
369 * see net/sched/sch_tbf.c in the linux source tree
372 /* Rusty: This is my (non-mathematically-inclined) understanding of
373 this algorithm. The `average rate' in jiffies becomes your initial
374 amount of credit `credit' and the most credit you can ever have
375 `credit_cap'. The `peak rate' becomes the cost of passing the
378 `prev' tracks the last packet hit: you gain one credit per jiffy.
379 If you get credit balance more than this, the extra credit is
380 discarded. Every time the match passes, you lose `cost' credits;
381 if you don't have that many, the test fails.
383 See Alexey's formal explanation in net/sched/sch_tbf.c.
385 To get the maximum range, we multiply by this factor (ie. you get N
386 credits per jiffy). We want to allow a rate as low as 1 per day
387 (slowest userspace tool allows), which means
388 CREDITS_PER_JIFFY*HZ*60*60*24 < 2^32 ie.
390 #define MAX_CPJ (0xFFFFFFFF / (HZ*60*60*24))
392 /* Repeated shift and or gives us all 1s, final shift and add 1 gives
393 * us the power of 2 below the theoretical max, so GCC simply does a
395 #define _POW2_BELOW2(x) ((x)|((x)>>1))
396 #define _POW2_BELOW4(x) (_POW2_BELOW2(x)|_POW2_BELOW2((x)>>2))
397 #define _POW2_BELOW8(x) (_POW2_BELOW4(x)|_POW2_BELOW4((x)>>4))
398 #define _POW2_BELOW16(x) (_POW2_BELOW8(x)|_POW2_BELOW8((x)>>8))
399 #define _POW2_BELOW32(x) (_POW2_BELOW16(x)|_POW2_BELOW16((x)>>16))
400 #define POW2_BELOW32(x) ((_POW2_BELOW32(x)>>1) + 1)
402 #define CREDITS_PER_JIFFY POW2_BELOW32(MAX_CPJ)
404 /* in byte mode, the lowest possible rate is one packet/second.
405 * credit_cap is used as a counter that tells us how many times we can
406 * refill the "credits available" counter when it becomes empty.
408 #define MAX_CPJ_BYTES (0xFFFFFFFF / HZ)
409 #define CREDITS_PER_JIFFY_BYTES POW2_BELOW32(MAX_CPJ_BYTES)
411 static u32
xt_hashlimit_len_to_chunks(u32 len
)
413 return (len
>> XT_HASHLIMIT_BYTE_SHIFT
) + 1;
416 /* Precision saver. */
417 static u32
user2credits(u32 user
)
419 /* If multiplying would overflow... */
420 if (user
> 0xFFFFFFFF / (HZ
*CREDITS_PER_JIFFY
))
422 return (user
/ XT_HASHLIMIT_SCALE
) * HZ
* CREDITS_PER_JIFFY
;
424 return (user
* HZ
* CREDITS_PER_JIFFY
) / XT_HASHLIMIT_SCALE
;
427 static u32
user2credits_byte(u32 user
)
430 us
*= HZ
* CREDITS_PER_JIFFY_BYTES
;
431 return (u32
) (us
>> 32);
434 static void rateinfo_recalc(struct dsthash_ent
*dh
, unsigned long now
, u32 mode
)
436 unsigned long delta
= now
- dh
->rateinfo
.prev
;
442 dh
->rateinfo
.prev
= now
;
444 if (mode
& XT_HASHLIMIT_BYTES
) {
445 u32 tmp
= dh
->rateinfo
.credit
;
446 dh
->rateinfo
.credit
+= CREDITS_PER_JIFFY_BYTES
* delta
;
447 cap
= CREDITS_PER_JIFFY_BYTES
* HZ
;
448 if (tmp
>= dh
->rateinfo
.credit
) {/* overflow */
449 dh
->rateinfo
.credit
= cap
;
453 dh
->rateinfo
.credit
+= delta
* CREDITS_PER_JIFFY
;
454 cap
= dh
->rateinfo
.credit_cap
;
456 if (dh
->rateinfo
.credit
> cap
)
457 dh
->rateinfo
.credit
= cap
;
460 static void rateinfo_init(struct dsthash_ent
*dh
,
461 struct xt_hashlimit_htable
*hinfo
)
463 dh
->rateinfo
.prev
= jiffies
;
464 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_BYTES
) {
465 dh
->rateinfo
.credit
= CREDITS_PER_JIFFY_BYTES
* HZ
;
466 dh
->rateinfo
.cost
= user2credits_byte(hinfo
->cfg
.avg
);
467 dh
->rateinfo
.credit_cap
= hinfo
->cfg
.burst
;
469 dh
->rateinfo
.credit
= user2credits(hinfo
->cfg
.avg
*
471 dh
->rateinfo
.cost
= user2credits(hinfo
->cfg
.avg
);
472 dh
->rateinfo
.credit_cap
= dh
->rateinfo
.credit
;
476 static inline __be32
maskl(__be32 a
, unsigned int l
)
478 return l
? htonl(ntohl(a
) & ~0 << (32 - l
)) : 0;
481 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
482 static void hashlimit_ipv6_mask(__be32
*i
, unsigned int p
)
486 i
[0] = maskl(i
[0], p
);
487 i
[1] = i
[2] = i
[3] = 0;
490 i
[1] = maskl(i
[1], p
- 32);
494 i
[2] = maskl(i
[2], p
- 64);
498 i
[3] = maskl(i
[3], p
- 96);
507 hashlimit_init_dst(const struct xt_hashlimit_htable
*hinfo
,
508 struct dsthash_dst
*dst
,
509 const struct sk_buff
*skb
, unsigned int protoff
)
511 __be16 _ports
[2], *ports
;
515 memset(dst
, 0, sizeof(*dst
));
517 switch (hinfo
->family
) {
519 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_DIP
)
520 dst
->ip
.dst
= maskl(ip_hdr(skb
)->daddr
,
522 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_SIP
)
523 dst
->ip
.src
= maskl(ip_hdr(skb
)->saddr
,
526 if (!(hinfo
->cfg
.mode
&
527 (XT_HASHLIMIT_HASH_DPT
| XT_HASHLIMIT_HASH_SPT
)))
529 nexthdr
= ip_hdr(skb
)->protocol
;
531 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
536 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_DIP
) {
537 memcpy(&dst
->ip6
.dst
, &ipv6_hdr(skb
)->daddr
,
538 sizeof(dst
->ip6
.dst
));
539 hashlimit_ipv6_mask(dst
->ip6
.dst
, hinfo
->cfg
.dstmask
);
541 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_SIP
) {
542 memcpy(&dst
->ip6
.src
, &ipv6_hdr(skb
)->saddr
,
543 sizeof(dst
->ip6
.src
));
544 hashlimit_ipv6_mask(dst
->ip6
.src
, hinfo
->cfg
.srcmask
);
547 if (!(hinfo
->cfg
.mode
&
548 (XT_HASHLIMIT_HASH_DPT
| XT_HASHLIMIT_HASH_SPT
)))
550 nexthdr
= ipv6_hdr(skb
)->nexthdr
;
551 protoff
= ipv6_skip_exthdr(skb
, sizeof(struct ipv6hdr
), &nexthdr
, &frag_off
);
552 if ((int)protoff
< 0)
562 poff
= proto_ports_offset(nexthdr
);
564 ports
= skb_header_pointer(skb
, protoff
+ poff
, sizeof(_ports
),
567 _ports
[0] = _ports
[1] = 0;
572 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_SPT
)
573 dst
->src_port
= ports
[0];
574 if (hinfo
->cfg
.mode
& XT_HASHLIMIT_HASH_DPT
)
575 dst
->dst_port
= ports
[1];
579 static u32
hashlimit_byte_cost(unsigned int len
, struct dsthash_ent
*dh
)
581 u64 tmp
= xt_hashlimit_len_to_chunks(len
);
582 tmp
= tmp
* dh
->rateinfo
.cost
;
584 if (unlikely(tmp
> CREDITS_PER_JIFFY_BYTES
* HZ
))
585 tmp
= CREDITS_PER_JIFFY_BYTES
* HZ
;
587 if (dh
->rateinfo
.credit
< tmp
&& dh
->rateinfo
.credit_cap
) {
588 dh
->rateinfo
.credit_cap
--;
589 dh
->rateinfo
.credit
= CREDITS_PER_JIFFY_BYTES
* HZ
;
595 hashlimit_mt(const struct sk_buff
*skb
, struct xt_action_param
*par
)
597 const struct xt_hashlimit_mtinfo1
*info
= par
->matchinfo
;
598 struct xt_hashlimit_htable
*hinfo
= info
->hinfo
;
599 unsigned long now
= jiffies
;
600 struct dsthash_ent
*dh
;
601 struct dsthash_dst dst
;
605 if (hashlimit_init_dst(hinfo
, &dst
, skb
, par
->thoff
) < 0)
609 dh
= dsthash_find(hinfo
, &dst
);
611 dh
= dsthash_alloc_init(hinfo
, &dst
, &race
);
613 rcu_read_unlock_bh();
616 /* Already got an entry, update expiration timeout */
617 dh
->expires
= now
+ msecs_to_jiffies(hinfo
->cfg
.expire
);
618 rateinfo_recalc(dh
, now
, hinfo
->cfg
.mode
);
620 dh
->expires
= jiffies
+ msecs_to_jiffies(hinfo
->cfg
.expire
);
621 rateinfo_init(dh
, hinfo
);
624 /* update expiration timeout */
625 dh
->expires
= now
+ msecs_to_jiffies(hinfo
->cfg
.expire
);
626 rateinfo_recalc(dh
, now
, hinfo
->cfg
.mode
);
629 if (info
->cfg
.mode
& XT_HASHLIMIT_BYTES
)
630 cost
= hashlimit_byte_cost(skb
->len
, dh
);
632 cost
= dh
->rateinfo
.cost
;
634 if (dh
->rateinfo
.credit
>= cost
) {
635 /* below the limit */
636 dh
->rateinfo
.credit
-= cost
;
637 spin_unlock(&dh
->lock
);
638 rcu_read_unlock_bh();
639 return !(info
->cfg
.mode
& XT_HASHLIMIT_INVERT
);
642 spin_unlock(&dh
->lock
);
643 rcu_read_unlock_bh();
644 /* default match is underlimit - so over the limit, we need to invert */
645 return info
->cfg
.mode
& XT_HASHLIMIT_INVERT
;
652 static int hashlimit_mt_check(const struct xt_mtchk_param
*par
)
654 struct net
*net
= par
->net
;
655 struct xt_hashlimit_mtinfo1
*info
= par
->matchinfo
;
658 if (info
->cfg
.gc_interval
== 0 || info
->cfg
.expire
== 0)
660 if (info
->name
[sizeof(info
->name
)-1] != '\0')
662 if (par
->family
== NFPROTO_IPV4
) {
663 if (info
->cfg
.srcmask
> 32 || info
->cfg
.dstmask
> 32)
666 if (info
->cfg
.srcmask
> 128 || info
->cfg
.dstmask
> 128)
670 if (info
->cfg
.mode
& ~XT_HASHLIMIT_ALL
) {
671 pr_info("Unknown mode mask %X, kernel too old?\n",
676 /* Check for overflow. */
677 if (info
->cfg
.mode
& XT_HASHLIMIT_BYTES
) {
678 if (user2credits_byte(info
->cfg
.avg
) == 0) {
679 pr_info("overflow, rate too high: %u\n", info
->cfg
.avg
);
682 } else if (info
->cfg
.burst
== 0 ||
683 user2credits(info
->cfg
.avg
* info
->cfg
.burst
) <
684 user2credits(info
->cfg
.avg
)) {
685 pr_info("overflow, try lower: %u/%u\n",
686 info
->cfg
.avg
, info
->cfg
.burst
);
690 mutex_lock(&hashlimit_mutex
);
691 info
->hinfo
= htable_find_get(net
, info
->name
, par
->family
);
692 if (info
->hinfo
== NULL
) {
693 ret
= htable_create(net
, info
, par
->family
);
695 mutex_unlock(&hashlimit_mutex
);
699 mutex_unlock(&hashlimit_mutex
);
703 static void hashlimit_mt_destroy(const struct xt_mtdtor_param
*par
)
705 const struct xt_hashlimit_mtinfo1
*info
= par
->matchinfo
;
707 htable_put(info
->hinfo
);
710 static struct xt_match hashlimit_mt_reg
[] __read_mostly
= {
714 .family
= NFPROTO_IPV4
,
715 .match
= hashlimit_mt
,
716 .matchsize
= sizeof(struct xt_hashlimit_mtinfo1
),
717 .checkentry
= hashlimit_mt_check
,
718 .destroy
= hashlimit_mt_destroy
,
721 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
725 .family
= NFPROTO_IPV6
,
726 .match
= hashlimit_mt
,
727 .matchsize
= sizeof(struct xt_hashlimit_mtinfo1
),
728 .checkentry
= hashlimit_mt_check
,
729 .destroy
= hashlimit_mt_destroy
,
736 static void *dl_seq_start(struct seq_file
*s
, loff_t
*pos
)
737 __acquires(htable
->lock
)
739 struct xt_hashlimit_htable
*htable
= s
->private;
740 unsigned int *bucket
;
742 spin_lock_bh(&htable
->lock
);
743 if (*pos
>= htable
->cfg
.size
)
746 bucket
= kmalloc(sizeof(unsigned int), GFP_ATOMIC
);
748 return ERR_PTR(-ENOMEM
);
754 static void *dl_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
756 struct xt_hashlimit_htable
*htable
= s
->private;
757 unsigned int *bucket
= (unsigned int *)v
;
760 if (*pos
>= htable
->cfg
.size
) {
767 static void dl_seq_stop(struct seq_file
*s
, void *v
)
768 __releases(htable
->lock
)
770 struct xt_hashlimit_htable
*htable
= s
->private;
771 unsigned int *bucket
= (unsigned int *)v
;
775 spin_unlock_bh(&htable
->lock
);
778 static int dl_seq_real_show(struct dsthash_ent
*ent
, u_int8_t family
,
782 const struct xt_hashlimit_htable
*ht
= s
->private;
784 spin_lock(&ent
->lock
);
785 /* recalculate to show accurate numbers */
786 rateinfo_recalc(ent
, jiffies
, ht
->cfg
.mode
);
790 res
= seq_printf(s
, "%ld %pI4:%u->%pI4:%u %u %u %u\n",
791 (long)(ent
->expires
- jiffies
)/HZ
,
793 ntohs(ent
->dst
.src_port
),
795 ntohs(ent
->dst
.dst_port
),
796 ent
->rateinfo
.credit
, ent
->rateinfo
.credit_cap
,
799 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
801 res
= seq_printf(s
, "%ld %pI6:%u->%pI6:%u %u %u %u\n",
802 (long)(ent
->expires
- jiffies
)/HZ
,
804 ntohs(ent
->dst
.src_port
),
806 ntohs(ent
->dst
.dst_port
),
807 ent
->rateinfo
.credit
, ent
->rateinfo
.credit_cap
,
815 spin_unlock(&ent
->lock
);
819 static int dl_seq_show(struct seq_file
*s
, void *v
)
821 struct xt_hashlimit_htable
*htable
= s
->private;
822 unsigned int *bucket
= (unsigned int *)v
;
823 struct dsthash_ent
*ent
;
824 struct hlist_node
*pos
;
826 if (!hlist_empty(&htable
->hash
[*bucket
])) {
827 hlist_for_each_entry(ent
, pos
, &htable
->hash
[*bucket
], node
)
828 if (dl_seq_real_show(ent
, htable
->family
, s
))
834 static const struct seq_operations dl_seq_ops
= {
835 .start
= dl_seq_start
,
841 static int dl_proc_open(struct inode
*inode
, struct file
*file
)
843 int ret
= seq_open(file
, &dl_seq_ops
);
846 struct seq_file
*sf
= file
->private_data
;
847 sf
->private = PDE(inode
)->data
;
852 static const struct file_operations dl_file_ops
= {
853 .owner
= THIS_MODULE
,
854 .open
= dl_proc_open
,
857 .release
= seq_release
860 static int __net_init
hashlimit_proc_net_init(struct net
*net
)
862 struct hashlimit_net
*hashlimit_net
= hashlimit_pernet(net
);
864 hashlimit_net
->ipt_hashlimit
= proc_mkdir("ipt_hashlimit", net
->proc_net
);
865 if (!hashlimit_net
->ipt_hashlimit
)
867 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
868 hashlimit_net
->ip6t_hashlimit
= proc_mkdir("ip6t_hashlimit", net
->proc_net
);
869 if (!hashlimit_net
->ip6t_hashlimit
) {
870 remove_proc_entry("ipt_hashlimit", net
->proc_net
);
877 static void __net_exit
hashlimit_proc_net_exit(struct net
*net
)
879 struct xt_hashlimit_htable
*hinfo
;
880 struct hlist_node
*pos
;
881 struct proc_dir_entry
*pde
;
882 struct hashlimit_net
*hashlimit_net
= hashlimit_pernet(net
);
884 /* recent_net_exit() is called before recent_mt_destroy(). Make sure
885 * that the parent xt_recent proc entry is is empty before trying to
888 mutex_lock(&hashlimit_mutex
);
889 pde
= hashlimit_net
->ipt_hashlimit
;
891 pde
= hashlimit_net
->ip6t_hashlimit
;
893 hlist_for_each_entry(hinfo
, pos
, &hashlimit_net
->htables
, node
)
894 remove_proc_entry(hinfo
->pde
->name
, pde
);
896 hashlimit_net
->ipt_hashlimit
= NULL
;
897 hashlimit_net
->ip6t_hashlimit
= NULL
;
898 mutex_unlock(&hashlimit_mutex
);
900 remove_proc_entry("ipt_hashlimit", net
->proc_net
);
901 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
902 remove_proc_entry("ip6t_hashlimit", net
->proc_net
);
906 static int __net_init
hashlimit_net_init(struct net
*net
)
908 struct hashlimit_net
*hashlimit_net
= hashlimit_pernet(net
);
910 INIT_HLIST_HEAD(&hashlimit_net
->htables
);
911 return hashlimit_proc_net_init(net
);
914 static void __net_exit
hashlimit_net_exit(struct net
*net
)
916 hashlimit_proc_net_exit(net
);
919 static struct pernet_operations hashlimit_net_ops
= {
920 .init
= hashlimit_net_init
,
921 .exit
= hashlimit_net_exit
,
922 .id
= &hashlimit_net_id
,
923 .size
= sizeof(struct hashlimit_net
),
926 static int __init
hashlimit_mt_init(void)
930 err
= register_pernet_subsys(&hashlimit_net_ops
);
933 err
= xt_register_matches(hashlimit_mt_reg
,
934 ARRAY_SIZE(hashlimit_mt_reg
));
939 hashlimit_cachep
= kmem_cache_create("xt_hashlimit",
940 sizeof(struct dsthash_ent
), 0, 0,
942 if (!hashlimit_cachep
) {
943 pr_warning("unable to create slab cache\n");
949 xt_unregister_matches(hashlimit_mt_reg
, ARRAY_SIZE(hashlimit_mt_reg
));
951 unregister_pernet_subsys(&hashlimit_net_ops
);
956 static void __exit
hashlimit_mt_exit(void)
958 xt_unregister_matches(hashlimit_mt_reg
, ARRAY_SIZE(hashlimit_mt_reg
));
959 unregister_pernet_subsys(&hashlimit_net_ops
);
962 kmem_cache_destroy(hashlimit_cachep
);
965 module_init(hashlimit_mt_init
);
966 module_exit(hashlimit_mt_exit
);