1 /* Shared library add-on to iptables to add limit support.
3 * Jérôme de Vivie <devivie@info.enserb.u-bordeaux.fr>
4 * Hervé Eychenne <rv@wallfire.org>
13 #include <linux/netfilter/x_tables.h>
14 /* For 64bit kernel / 32bit userspace */
15 #include "../include/linux/netfilter/xt_limit.h"
17 #define XT_LIMIT_AVG "3/hour"
18 #define XT_LIMIT_BURST 5
20 /* Function which prints out usage message. */
21 static void limit_help(void)
24 "limit match options:\n"
25 "--limit avg max average match rate: default "XT_LIMIT_AVG"\n"
26 " [Packets per second unless followed by \n"
27 " /sec /minute /hour /day postfixes]\n"
28 "--limit-burst number number to match in a burst, default %u\n",
32 static const struct option limit_opts[] = {
33 { "limit", 1, NULL, '%' },
34 { "limit-burst", 1, NULL, '$' },
39 int parse_rate(const char *rate, u_int32_t *val)
43 u_int32_t mult = 1; /* Seconds by default. */
45 delim = strchr(rate, '/');
47 if (strlen(delim+1) == 0)
50 if (strncasecmp(delim+1, "second", strlen(delim+1)) == 0)
52 else if (strncasecmp(delim+1, "minute", strlen(delim+1)) == 0)
54 else if (strncasecmp(delim+1, "hour", strlen(delim+1)) == 0)
56 else if (strncasecmp(delim+1, "day", strlen(delim+1)) == 0)
65 /* This would get mapped to infinite (1/day is minimum they
66 can specify, so we're ok at that end). */
67 if (r / mult > XT_LIMIT_SCALE)
68 exit_error(PARAMETER_PROBLEM, "Rate too fast `%s'\n", rate);
70 *val = XT_LIMIT_SCALE * mult / r;
74 /* Initialize the match. */
75 static void limit_init(struct xt_entry_match *m)
77 struct xt_rateinfo *r = (struct xt_rateinfo *)m->data;
79 parse_rate(XT_LIMIT_AVG, &r->avg);
80 r->burst = XT_LIMIT_BURST;
84 /* FIXME: handle overflow:
85 if (r->avg*r->burst/r->burst != r->avg)
86 exit_error(PARAMETER_PROBLEM,
87 "Sorry: burst too large for that avg rate.\n");
90 /* Function which parses command options; returns true if it
93 limit_parse(int c, char **argv, int invert, unsigned int *flags,
94 const void *entry, struct xt_entry_match **match)
96 struct xt_rateinfo *r = (struct xt_rateinfo *)(*match)->data;
101 if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
102 if (!parse_rate(optarg, &r->avg))
103 exit_error(PARAMETER_PROBLEM,
104 "bad rate `%s'", optarg);
108 if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
109 if (string_to_number(optarg, 0, 10000, &num) == -1)
110 exit_error(PARAMETER_PROBLEM,
111 "bad --limit-burst `%s'", optarg);
120 exit_error(PARAMETER_PROBLEM,
121 "limit does not support invert");
126 static const struct rates
130 } rates[] = { { "day", XT_LIMIT_SCALE*24*60*60 },
131 { "hour", XT_LIMIT_SCALE*60*60 },
132 { "min", XT_LIMIT_SCALE*60 },
133 { "sec", XT_LIMIT_SCALE } };
135 static void print_rate(u_int32_t period)
139 for (i = 1; i < sizeof(rates)/sizeof(struct rates); i++) {
140 if (period > rates[i].mult
141 || rates[i].mult/period < rates[i].mult%period)
145 printf("%u/%s ", rates[i-1].mult / period, rates[i-1].name);
148 /* Prints out the matchinfo. */
150 limit_print(const void *ip, const struct xt_entry_match *match, int numeric)
152 struct xt_rateinfo *r = (struct xt_rateinfo *)match->data;
153 printf("limit: avg "); print_rate(r->avg);
154 printf("burst %u ", r->burst);
157 /* FIXME: Make minimalist: only print rate if not default --RR */
158 static void limit_save(const void *ip, const struct xt_entry_match *match)
160 struct xt_rateinfo *r = (struct xt_rateinfo *)match->data;
162 printf("--limit "); print_rate(r->avg);
163 if (r->burst != XT_LIMIT_BURST)
164 printf("--limit-burst %u ", r->burst);
167 static struct xtables_match limit_match = {
170 .version = XTABLES_VERSION,
171 .size = XT_ALIGN(sizeof(struct xt_rateinfo)),
172 .userspacesize = offsetof(struct xt_rateinfo, prev),
175 .parse = limit_parse,
176 .print = limit_print,
178 .extra_opts = limit_opts,
183 xtables_register_match(&limit_match);