#include <stdbool.h> #include <stdio.h> #include <string.h> #include <xtables.h> #include <linux/netfilter/xt_recent.h> enum { O_SET = 0, O_RCHECK, O_UPDATE, O_REMOVE, O_SECONDS, O_REAP, O_HITCOUNT, O_RTTL, O_NAME, O_RSOURCE, O_RDEST, O_MASK, F_SET = 1 << O_SET, F_RCHECK = 1 << O_RCHECK, F_UPDATE = 1 << O_UPDATE, F_REMOVE = 1 << O_REMOVE, F_SECONDS = 1 << O_SECONDS, F_ANY_OP = F_SET | F_RCHECK | F_UPDATE | F_REMOVE, }; #define s struct xt_recent_mtinfo static const struct xt_option_entry recent_opts_v0[] = { {.name = "set", .id = O_SET, .type = XTTYPE_NONE, .excl = F_ANY_OP, .flags = XTOPT_INVERT}, {.name = "rcheck", .id = O_RCHECK, .type = XTTYPE_NONE, .excl = F_ANY_OP, .flags = XTOPT_INVERT}, {.name = "update", .id = O_UPDATE, .type = XTTYPE_NONE, .excl = F_ANY_OP, .flags = XTOPT_INVERT}, {.name = "remove", .id = O_REMOVE, .type = XTTYPE_NONE, .excl = F_ANY_OP, .flags = XTOPT_INVERT}, {.name = "seconds", .id = O_SECONDS, .type = XTTYPE_UINT32, .flags = XTOPT_PUT, XTOPT_POINTER(s, seconds), .min = 1}, {.name = "reap", .id = O_REAP, .type = XTTYPE_NONE, .also = F_SECONDS }, {.name = "hitcount", .id = O_HITCOUNT, .type = XTTYPE_UINT32, .flags = XTOPT_PUT, XTOPT_POINTER(s, hit_count)}, {.name = "rttl", .id = O_RTTL, .type = XTTYPE_NONE, .excl = F_SET | F_REMOVE}, {.name = "name", .id = O_NAME, .type = XTTYPE_STRING, .flags = XTOPT_PUT, XTOPT_POINTER(s, name)}, {.name = "rsource", .id = O_RSOURCE, .type = XTTYPE_NONE}, {.name = "rdest", .id = O_RDEST, .type = XTTYPE_NONE}, XTOPT_TABLEEND, }; #undef s #define s struct xt_recent_mtinfo_v1 static const struct xt_option_entry recent_opts_v1[] = { {.name = "set", .id = O_SET, .type = XTTYPE_NONE, .excl = F_ANY_OP, .flags = XTOPT_INVERT}, {.name = "rcheck", .id = O_RCHECK, .type = XTTYPE_NONE, .excl = F_ANY_OP, .flags = XTOPT_INVERT}, {.name = "update", .id = O_UPDATE, .type = XTTYPE_NONE, .excl = F_ANY_OP, .flags = XTOPT_INVERT}, {.name = "remove", .id = O_REMOVE, .type = XTTYPE_NONE, .excl = F_ANY_OP, .flags = XTOPT_INVERT}, {.name = "seconds", .id = O_SECONDS, .type = XTTYPE_UINT32, .flags = XTOPT_PUT, XTOPT_POINTER(s, seconds), .min = 1}, {.name = "reap", .id = O_REAP, .type = XTTYPE_NONE, .also = F_SECONDS }, {.name = "hitcount", .id = O_HITCOUNT, .type = XTTYPE_UINT32, .flags = XTOPT_PUT, XTOPT_POINTER(s, hit_count)}, {.name = "rttl", .id = O_RTTL, .type = XTTYPE_NONE, .excl = F_SET | F_REMOVE}, {.name = "name", .id = O_NAME, .type = XTTYPE_STRING, .flags = XTOPT_PUT, XTOPT_POINTER(s, name)}, {.name = "rsource", .id = O_RSOURCE, .type = XTTYPE_NONE}, {.name = "rdest", .id = O_RDEST, .type = XTTYPE_NONE}, {.name = "mask", .id = O_MASK, .type = XTTYPE_HOST, .flags = XTOPT_PUT, XTOPT_POINTER(s, mask)}, XTOPT_TABLEEND, }; #undef s static void recent_help(void) { printf( "recent match options:\n" "[!] --set Add source address to list, always matches.\n" "[!] --rcheck Match if source address in list.\n" "[!] --update Match if source address in list, also update last-seen time.\n" "[!] --remove Match if source address in list, also removes that address from list.\n" " --seconds seconds For check and update commands above.\n" " Specifies that the match will only occur if source address last seen within\n" " the last 'seconds' seconds.\n" " --reap Purge entries older then 'seconds'.\n" " Can only be used in conjunction with the seconds option.\n" " --hitcount hits For check and update commands above.\n" " Specifies that the match will only occur if source address seen hits times.\n" " May be used in conjunction with the seconds option.\n" " --rttl For check and update commands above.\n" " Specifies that the match will only occur if the source address and the TTL\n" " match between this packet and the one which was set.\n" " Useful if you have problems with people spoofing their source address in order\n" " to DoS you via this module.\n" " --name name Name of the recent list to be used. DEFAULT used if none given.\n" " --rsource Match/Save the source address of each packet in the recent list table (default).\n" " --rdest Match/Save the destination address of each packet in the recent list table.\n" " --mask netmask Netmask that will be applied to this recent list.\n" "xt_recent by: Stephen Frost <sfrost@snowman.net>.\n"); } enum { XT_RECENT_REV_0 = 0, XT_RECENT_REV_1, }; static void recent_init(struct xt_entry_match *match, unsigned int rev) { struct xt_recent_mtinfo *info = (struct xt_recent_mtinfo *)match->data; struct xt_recent_mtinfo_v1 *info_v1 = (struct xt_recent_mtinfo_v1 *)match->data; strncpy(info->name,"DEFAULT", XT_RECENT_NAME_LEN); /* even though XT_RECENT_NAME_LEN is currently defined as 200, * better be safe, than sorry */ info->name[XT_RECENT_NAME_LEN-1] = '\0'; info->side = XT_RECENT_SOURCE; if (rev == XT_RECENT_REV_1) memset(&info_v1->mask, 0xFF, sizeof(info_v1->mask)); } static void recent_parse(struct xt_option_call *cb) { struct xt_recent_mtinfo *info = cb->data; xtables_option_parse(cb); switch (cb->entry->id) { case O_SET: info->check_set |= XT_RECENT_SET; if (cb->invert) info->invert = true; break; case O_RCHECK: info->check_set |= XT_RECENT_CHECK; if (cb->invert) info->invert = true; break; case O_UPDATE: info->check_set |= XT_RECENT_UPDATE; if (cb->invert) info->invert = true; break; case O_REMOVE: info->check_set |= XT_RECENT_REMOVE; if (cb->invert) info->invert = true; break; case O_RTTL: info->check_set |= XT_RECENT_TTL; break; case O_RSOURCE: info->side = XT_RECENT_SOURCE; break; case O_RDEST: info->side = XT_RECENT_DEST; break; case O_REAP: info->check_set |= XT_RECENT_REAP; break; } } static void recent_check(struct xt_fcheck_call *cb) { if (!(cb->xflags & F_ANY_OP)) xtables_error(PARAMETER_PROBLEM, "recent: you must specify one of `--set', `--rcheck' " "`--update' or `--remove'"); } static void recent_print(const void *ip, const struct xt_entry_match *match, unsigned int family) { const struct xt_recent_mtinfo_v1 *info = (const void *)match->data; if (info->invert) printf(" !"); printf(" recent:"); if (info->check_set & XT_RECENT_SET) printf(" SET"); if (info->check_set & XT_RECENT_CHECK) printf(" CHECK"); if (info->check_set & XT_RECENT_UPDATE) printf(" UPDATE"); if (info->check_set & XT_RECENT_REMOVE) printf(" REMOVE"); if(info->seconds) printf(" seconds: %d", info->seconds); if (info->check_set & XT_RECENT_REAP) printf(" reap"); if(info->hit_count) printf(" hit_count: %d", info->hit_count); if (info->check_set & XT_RECENT_TTL) printf(" TTL-Match"); if(info->name) printf(" name: %s", info->name); if (info->side == XT_RECENT_SOURCE) printf(" side: source"); if (info->side == XT_RECENT_DEST) printf(" side: dest"); switch(family) { case NFPROTO_IPV4: printf(" mask: %s", xtables_ipaddr_to_numeric(&info->mask.in)); break; case NFPROTO_IPV6: printf(" mask: %s", xtables_ip6addr_to_numeric(&info->mask.in6)); break; } } static void recent_save(const void *ip, const struct xt_entry_match *match, unsigned int family) { const struct xt_recent_mtinfo_v1 *info = (const void *)match->data; if (info->invert) printf(" !"); if (info->check_set & XT_RECENT_SET) printf(" --set"); if (info->check_set & XT_RECENT_CHECK) printf(" --rcheck"); if (info->check_set & XT_RECENT_UPDATE) printf(" --update"); if (info->check_set & XT_RECENT_REMOVE) printf(" --remove"); if(info->seconds) printf(" --seconds %d", info->seconds); if (info->check_set & XT_RECENT_REAP) printf(" --reap"); if(info->hit_count) printf(" --hitcount %d", info->hit_count); if (info->check_set & XT_RECENT_TTL) printf(" --rttl"); if(info->name) printf(" --name %s",info->name); switch(family) { case NFPROTO_IPV4: printf(" --mask %s", xtables_ipaddr_to_numeric(&info->mask.in)); break; case NFPROTO_IPV6: printf(" --mask %s", xtables_ip6addr_to_numeric(&info->mask.in6)); break; } if (info->side == XT_RECENT_SOURCE) printf(" --rsource"); if (info->side == XT_RECENT_DEST) printf(" --rdest"); } static void recent_init_v0(struct xt_entry_match *match) { recent_init(match, XT_RECENT_REV_0); } static void recent_init_v1(struct xt_entry_match *match) { recent_init(match, XT_RECENT_REV_1); } static void recent_save_v0(const void *ip, const struct xt_entry_match *match) { recent_save(ip, match, NFPROTO_UNSPEC); } static void recent_save_v4(const void *ip, const struct xt_entry_match *match) { recent_save(ip, match, NFPROTO_IPV4); } static void recent_save_v6(const void *ip, const struct xt_entry_match *match) { recent_save(ip, match, NFPROTO_IPV6); } static void recent_print_v0(const void *ip, const struct xt_entry_match *match, int numeric) { recent_print(ip, match, NFPROTO_UNSPEC); } static void recent_print_v4(const void *ip, const struct xt_entry_match *match, int numeric) { recent_print(ip, match, NFPROTO_IPV4); } static void recent_print_v6(const void *ip, const struct xt_entry_match *match, int numeric) { recent_print(ip, match, NFPROTO_IPV6); } static struct xtables_match recent_mt_reg[] = { { .name = "recent", .version = XTABLES_VERSION, .revision = 0, .family = NFPROTO_UNSPEC, .size = XT_ALIGN(sizeof(struct xt_recent_mtinfo)), .userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo)), .help = recent_help, .init = recent_init_v0, .x6_parse = recent_parse, .x6_fcheck = recent_check, .print = recent_print_v0, .save = recent_save_v0, .x6_options = recent_opts_v0, }, { .name = "recent", .version = XTABLES_VERSION, .revision = 1, .family = NFPROTO_IPV4, .size = XT_ALIGN(sizeof(struct xt_recent_mtinfo_v1)), .userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo_v1)), .help = recent_help, .init = recent_init_v1, .x6_parse = recent_parse, .x6_fcheck = recent_check, .print = recent_print_v4, .save = recent_save_v4, .x6_options = recent_opts_v1, }, { .name = "recent", .version = XTABLES_VERSION, .revision = 1, .family = NFPROTO_IPV6, .size = XT_ALIGN(sizeof(struct xt_recent_mtinfo_v1)), .userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo_v1)), .help = recent_help, .init = recent_init_v1, .x6_parse = recent_parse, .x6_fcheck = recent_check, .print = recent_print_v6, .save = recent_save_v6, .x6_options = recent_opts_v1, }, }; void _init(void) { xtables_register_matches(recent_mt_reg, ARRAY_SIZE(recent_mt_reg)); }