Dear All
I just wrote patch for recent module, to add option --mask. Please dont
hit me hard, since i am newbie for this stuff :)
Use case for this feature:
1)In some occasions i need to allow,block,match whole /24 subnet or
other mask.
2)I can use recent as a trigger, e.g.:
iptables -I OUTPUT -p icmp -d 8.8.8.8/32 -m recent --name X --set
--mask 0.0.0.0 -j ACCEPT
iptables -I OUTPUT -p icmp -d 2.2.2.10 -m recent --name X --rcheck
--mask 0.0.0.0 -j REJECT
vm ~ # ping 2.2.2.10 -c 2 -i 1;ping -c 1 8.8.8.8;ping -i 1 -c15
2.2.2.10
PING 2.2.2.10 (2.2.2.10) 56(84) bytes of data.
64 bytes from 2.2.2.10: icmp_req=1 ttl=62 time=0.733 ms
64 bytes from 2.2.2.10: icmp_req=2 ttl=62 time=0.768 ms
--- 2.2.2.10 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.733/0.750/0.768/0.032 ms
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_req=1 ttl=48 time=139 ms
--- 8.8.8.8 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 139.251/139.251/139.251/0.000 ms
PING 2.2.2.10 (2.2.2.10) 56(84) bytes of data.
From 192.168.122.150: icmp_seq=1 Destination Port Unreachable
From 192.168.122.150: icmp_seq=1 Destination Port Unreachable
From 192.168.122.150: icmp_seq=1 Destination Port Unreachable
From 192.168.122.150: icmp_seq=1 Destination Port Unreachable
From 192.168.122.150: icmp_seq=1 Destination Port Unreachable
From 192.168.122.150: icmp_seq=1 Destination Port Unreachable
From 192.168.122.150: icmp_seq=1 Destination Port Unreachable
From 192.168.122.150: icmp_seq=1 Destination Port Unreachable
From 192.168.122.150: icmp_seq=1 Destination Port Unreachable
From 192.168.122.150: icmp_seq=1 Destination Port Unreachable
From 192.168.122.150: icmp_seq=1 Destination Port Unreachable
From 192.168.122.150: icmp_seq=1 Destination Port Unreachable
From 192.168.122.150: icmp_seq=1 Destination Port Unreachable
From 192.168.122.150: icmp_seq=1 Destination Port Unreachable
From 192.168.122.150: icmp_seq=1 Destination Port Unreachable
--- 2.2.2.10 ping statistics ---
0 packets transmitted, 0 received, +15 errors
Tested for backward compatibility:
old iptables, new kernel
old kernel, new iptables
new kernel, new iptables
Patches attached
diff -Naur iptables-1.4.12.1/extensions/libxt_recent.c iptables-1.4.12.1-mod/extensions/libxt_recent.c
--- iptables-1.4.12.1/extensions/libxt_recent.c 2011-09-01 19:30:42.000000000 +0300
+++ iptables-1.4.12.1-mod/extensions/libxt_recent.c 2012-03-01 21:46:10.814573539 +0200
@@ -15,6 +15,7 @@
O_NAME,
O_RSOURCE,
O_RDEST,
+ O_MASK,
F_SET = 1 << O_SET,
F_RCHECK = 1 << O_RCHECK,
F_UPDATE = 1 << O_UPDATE,
@@ -23,7 +24,7 @@
};
#define s struct xt_recent_mtinfo
-static const struct xt_option_entry recent_opts[] = {
+static const struct xt_option_entry recent_opts_v0[] = {
{.name = "set", .id = O_SET, .type = XTTYPE_NONE,
.excl = F_ANY_OP, .flags = XTOPT_INVERT},
{.name = "rcheck", .id = O_RCHECK, .type = XTTYPE_NONE,
@@ -46,6 +47,33 @@
};
#undef s
+#define s struct xt_recent_mtinfo_v1
+static const struct xt_option_entry recent_opts_v1[] = {
+ {.name = "set", .id = O_SET, .type = XTTYPE_NONE,
+ .excl = F_ANY_OP, .flags = XTOPT_INVERT},
+ {.name = "rcheck", .id = O_RCHECK, .type = XTTYPE_NONE,
+ .excl = F_ANY_OP, .flags = XTOPT_INVERT},
+ {.name = "update", .id = O_UPDATE, .type = XTTYPE_NONE,
+ .excl = F_ANY_OP, .flags = XTOPT_INVERT},
+ {.name = "remove", .id = O_REMOVE, .type = XTTYPE_NONE,
+ .excl = F_ANY_OP, .flags = XTOPT_INVERT},
+ {.name = "seconds", .id = O_SECONDS, .type = XTTYPE_UINT32,
+ .flags = XTOPT_PUT, XTOPT_POINTER(s, seconds)},
+ {.name = "hitcount", .id = O_HITCOUNT, .type = XTTYPE_UINT32,
+ .flags = XTOPT_PUT, XTOPT_POINTER(s, hit_count)},
+ {.name = "rttl", .id = O_RTTL, .type = XTTYPE_NONE,
+ .excl = F_SET | F_REMOVE},
+ {.name = "name", .id = O_NAME, .type = XTTYPE_STRING,
+ .flags = XTOPT_PUT, XTOPT_POINTER(s, name)},
+ {.name = "rsource", .id = O_RSOURCE, .type = XTTYPE_NONE},
+ {.name = "rdest", .id = O_RDEST, .type = XTTYPE_NONE},
+ {.name = "mask", .id = O_MASK, .type = XTTYPE_HOST,
+ .flags = XTOPT_PUT, XTOPT_POINTER(s, mask)},
+ XTOPT_TABLEEND,
+};
+#undef s
+
+
static void recent_help(void)
{
printf(
@@ -68,24 +96,27 @@
" --name name Name of the recent list to be used. DEFAULT used if none given.\n"
" --rsource Match/Save the source address of each packet in the recent list table (default).\n"
" --rdest Match/Save the destination address of each packet in the recent list table.\n"
+" --mask netmask Netmask that will be applied to this recent list.\n"
"xt_recent by: Stephen Frost <sfrost@xxxxxxxxxxx>. http://snowman.net/projects/ipt_recent/\n";);
}
-static void recent_init(struct xt_entry_match *match)
+static void recent_init(struct xt_entry_match *match,unsigned int family)
{
- struct xt_recent_mtinfo *info = (void *)(match)->data;
+ struct xt_recent_mtinfo *info_v0 = (void *)(match)->data;
+ struct xt_recent_mtinfo_v1 *info_v1 = (void *)(match)->data;
- strncpy(info->name,"DEFAULT", XT_RECENT_NAME_LEN);
+ strncpy(info_v0->name,"DEFAULT", XT_RECENT_NAME_LEN);
/* even though XT_RECENT_NAME_LEN is currently defined as 200,
* better be safe, than sorry */
- info->name[XT_RECENT_NAME_LEN-1] = '\0';
- info->side = XT_RECENT_SOURCE;
+ info_v0->name[XT_RECENT_NAME_LEN-1] = '\0';
+ info_v0->side = XT_RECENT_SOURCE;
+ if (family == NFPROTO_IPV6)
+ memset(&info_v1->mask,0xFF,sizeof(info_v1->mask));
}
static void recent_parse(struct xt_option_call *cb)
{
struct xt_recent_mtinfo *info = cb->data;
-
xtables_option_parse(cb);
switch (cb->entry->id) {
case O_SET:
@@ -129,9 +160,9 @@
}
static void recent_print(const void *ip, const struct xt_entry_match *match,
- int numeric)
+ unsigned int family)
{
- const struct xt_recent_mtinfo *info = (const void *)match->data;
+ const struct xt_recent_mtinfo_v1 *info = (const void *)match->data;
if (info->invert)
printf(" !");
@@ -154,11 +185,17 @@
printf(" side: source");
if (info->side == XT_RECENT_DEST)
printf(" side: dest");
+ if (family == NFPROTO_IPV4)
+ printf(" mask: %s",
+ xtables_ipaddr_to_numeric(&info->mask.in));
+ if (family == NFPROTO_IPV6)
+ printf(" mask: %s",
+ xtables_ip6addr_to_numeric(&info->mask.in6));
}
-static void recent_save(const void *ip, const struct xt_entry_match *match)
+static void recent_save(const void *ip, const struct xt_entry_match *match,unsigned int family)
{
- const struct xt_recent_mtinfo *info = (const void *)match->data;
+ const struct xt_recent_mtinfo_v1 *info = (const void *)match->data;
if (info->invert)
printf(" !");
@@ -176,28 +213,107 @@
if (info->check_set & XT_RECENT_TTL)
printf(" --rttl");
if(info->name) printf(" --name %s",info->name);
+ if (family == NFPROTO_IPV4)
+ printf(" --mask %s",
+ xtables_ipaddr_to_numeric(&info->mask.in));
+ if (family == NFPROTO_IPV6)
+ printf(" --mask %s",
+ xtables_ip6addr_to_numeric(&info->mask.in6));
+
if (info->side == XT_RECENT_SOURCE)
printf(" --rsource");
if (info->side == XT_RECENT_DEST)
printf(" --rdest");
}
-static struct xtables_match recent_mt_reg = {
- .name = "recent",
+static void recent_init_v0(struct xt_entry_match *match) {
+ recent_init(match,NFPROTO_UNSPEC);
+}
+
+static void recent_init_v1(struct xt_entry_match *match) {
+ recent_init(match,NFPROTO_IPV6);
+}
+
+static void recent_save_v0(const void *ip, const struct xt_entry_match *match)
+{
+ recent_save(ip,match,NFPROTO_UNSPEC);
+}
+
+static void recent_save_v4(const void *ip, const struct xt_entry_match *match)
+{
+ recent_save(ip,match,NFPROTO_IPV4);
+}
+
+static void recent_save_v6(const void *ip, const struct xt_entry_match *match)
+{
+ recent_save(ip,match,NFPROTO_IPV6);
+}
+
+static void recent_print_v0(const void *ip, const struct xt_entry_match *match,
+ int numeric)
+{
+ recent_print(ip,match,NFPROTO_UNSPEC);
+}
+
+static void recent_print_v4(const void *ip, const struct xt_entry_match *match,
+ int numeric)
+{
+ recent_print(ip,match,NFPROTO_IPV4);
+}
+
+static void recent_print_v6(const void *ip, const struct xt_entry_match *match,
+ int numeric)
+{
+ recent_print(ip,match,NFPROTO_IPV6);
+}
+
+static struct xtables_match recent_mt_reg[] = {
+ { .name = "recent",
.version = XTABLES_VERSION,
+ .revision = 0,
.family = NFPROTO_UNSPEC,
.size = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
.userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
.help = recent_help,
- .init = recent_init,
+ .init = recent_init_v0,
+ .x6_parse = recent_parse,
+ .x6_fcheck = recent_check,
+ .print = recent_print_v0,
+ .save = recent_save_v0,
+ .x6_options = recent_opts_v0,
+ },
+ { .name = "recent",
+ .version = XTABLES_VERSION,
+ .revision = 1,
+ .family = NFPROTO_IPV4,
+ .size = XT_ALIGN(sizeof(struct xt_recent_mtinfo_v1)),
+ .userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo_v1)),
+ .help = recent_help,
+ .init = recent_init_v1,
+ .x6_parse = recent_parse,
+ .x6_fcheck = recent_check,
+ .print = recent_print_v4,
+ .save = recent_save_v4,
+ .x6_options = recent_opts_v1,
+ },
+ { .name = "recent",
+ .version = XTABLES_VERSION,
+ .revision = 1,
+ .family = NFPROTO_IPV6,
+ .size = XT_ALIGN(sizeof(struct xt_recent_mtinfo_v1)),
+ .userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo_v1)),
+ .help = recent_help,
+ .init = recent_init_v1,
.x6_parse = recent_parse,
.x6_fcheck = recent_check,
- .print = recent_print,
- .save = recent_save,
- .x6_options = recent_opts,
+ .print = recent_print_v6,
+ .save = recent_save_v6,
+ .x6_options = recent_opts_v1,
+ }
};
void _init(void)
{
- xtables_register_match(&recent_mt_reg);
+ xtables_register_matches(recent_mt_reg,
+ ARRAY_SIZE(recent_mt_reg));
}
diff -Naur iptables-1.4.12.1/include/linux/netfilter/xt_recent.h iptables-1.4.12.1-mod/include/linux/netfilter/xt_recent.h
--- iptables-1.4.12.1/include/linux/netfilter/xt_recent.h 2011-09-01 19:30:42.000000000 +0300
+++ iptables-1.4.12.1-mod/include/linux/netfilter/xt_recent.h 2012-03-01 19:38:16.838997916 +0200
@@ -22,7 +22,6 @@
#define XT_RECENT_VALID_FLAGS (XT_RECENT_CHECK|XT_RECENT_SET|XT_RECENT_UPDATE|\
XT_RECENT_REMOVE|XT_RECENT_TTL|XT_RECENT_REAP)
-
struct xt_recent_mtinfo {
__u32 seconds;
__u32 hit_count;
@@ -32,4 +31,14 @@
__u8 side;
};
+struct xt_recent_mtinfo_v1 {
+ __u32 seconds;
+ __u32 hit_count;
+ __u8 check_set;
+ __u8 invert;
+ char name[XT_RECENT_NAME_LEN];
+ __u8 side;
+ union nf_inet_addr mask;
+};
+
#endif /* _LINUX_NETFILTER_XT_RECENT_H */
diff -Naur linux-3.2.9/include/linux/netfilter/xt_recent.h linux-3.2.9-custom/include/linux/netfilter/xt_recent.h
--- linux-3.2.9/include/linux/netfilter/xt_recent.h 2012-03-01 02:32:49.000000000 +0200
+++ linux-3.2.9-custom/include/linux/netfilter/xt_recent.h 2012-03-01 19:39:10.674001660 +0200
@@ -32,4 +32,14 @@
__u8 side;
};
+struct xt_recent_mtinfo_v1 {
+ __u32 seconds;
+ __u32 hit_count;
+ __u8 check_set;
+ __u8 invert;
+ char name[XT_RECENT_NAME_LEN];
+ __u8 side;
+ union nf_inet_addr mask;
+};
+
#endif /* _LINUX_NETFILTER_XT_RECENT_H */
diff -Naur linux-3.2.9/include/linux/netfilter.h linux-3.2.9-custom/include/linux/netfilter.h
--- linux-3.2.9/include/linux/netfilter.h 2012-03-01 02:32:49.000000000 +0200
+++ linux-3.2.9-custom/include/linux/netfilter.h 2012-03-01 12:41:23.000000000 +0200
@@ -85,6 +85,17 @@
return -(verdict >> NF_VERDICT_QBITS);
}
+
+static inline void nf_inet_addr_mask(const union nf_inet_addr *a1,
+ union nf_inet_addr *result,
+ const union nf_inet_addr *mask)
+{
+ result->all[0] = a1->all[0] & mask->all[0];
+ result->all[1] = a1->all[1] & mask->all[1];
+ result->all[2] = a1->all[2] & mask->all[2];
+ result->all[3] = a1->all[3] & mask->all[3];
+}
+
static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1,
const union nf_inet_addr *a2)
{
diff -Naur linux-3.2.9/net/netfilter/xt_recent.c linux-3.2.9-custom/net/netfilter/xt_recent.c
--- linux-3.2.9/net/netfilter/xt_recent.c 2012-03-01 02:32:49.000000000 +0200
+++ linux-3.2.9-custom/net/netfilter/xt_recent.c 2012-03-01 22:23:33.969742684 +0200
@@ -75,6 +75,7 @@
struct recent_table {
struct list_head list;
char name[XT_RECENT_NAME_LEN];
+ union nf_inet_addr mask;
unsigned int refcnt;
unsigned int entries;
struct list_head lru_list;
@@ -228,10 +229,11 @@
{
struct net *net = dev_net(par->in ? par->in : par->out);
struct recent_net *recent_net = recent_pernet(net);
- const struct xt_recent_mtinfo *info = par->matchinfo;
+ const struct xt_recent_mtinfo_v1 *info = par->matchinfo;
struct recent_table *t;
struct recent_entry *e;
union nf_inet_addr addr = {};
+ union nf_inet_addr addr_masked;
u_int8_t ttl;
bool ret = info->invert;
@@ -261,12 +263,15 @@
spin_lock_bh(&recent_lock);
t = recent_table_lookup(recent_net, info->name);
- e = recent_entry_lookup(t, &addr, par->family,
+
+ nf_inet_addr_mask(&addr,&addr_masked,&t->mask);
+
+ e = recent_entry_lookup(t, &addr_masked, par->family,
(info->check_set & XT_RECENT_TTL) ? ttl : 0);
if (e == NULL) {
if (!(info->check_set & XT_RECENT_SET))
goto out;
- e = recent_entry_init(t, &addr, par->family, ttl);
+ e = recent_entry_init(t, &addr_masked, par->family, ttl);
if (e == NULL)
par->hotdrop = true;
ret = !ret;
@@ -306,10 +311,10 @@
return ret;
}
-static int recent_mt_check(const struct xt_mtchk_param *par)
+static int recent_mt_check(const struct xt_mtchk_param *par, const struct xt_recent_mtinfo_v1 *info)
{
struct recent_net *recent_net = recent_pernet(par->net);
- const struct xt_recent_mtinfo *info = par->matchinfo;
+// const struct xt_recent_mtinfo_v1 *info = par->matchinfo;
struct recent_table *t;
#ifdef CONFIG_PROC_FS
struct proc_dir_entry *pde;
@@ -361,6 +366,8 @@
goto out;
}
t->refcnt = 1;
+
+ memcpy(&t->mask,&info->mask,sizeof(t->mask));
strcpy(t->name, info->name);
INIT_LIST_HEAD(&t->lru_list);
for (i = 0; i < ip_list_hash_size; i++)
@@ -385,10 +392,37 @@
return ret;
}
+static int recent_mt_check_v0(const struct xt_mtchk_param *par)
+{
+ const struct xt_recent_mtinfo_v0 *info_v0 = par->matchinfo;
+ struct xt_recent_mtinfo_v1 *info_v1 = par->matchinfo;
+ int ret;
+
+ info_v1 = kzalloc(sizeof(struct xt_recent_mtinfo_v1),
+ GFP_KERNEL);
+ if (info_v1 == NULL) {
+ return -ENOMEM;
+ }
+
+ /* Copy old data */
+ memcpy(info_v1,info_v0,sizeof(struct xt_recent_mtinfo));
+ /* Default mask will make same behavior as old recent */
+ memset(info_v1->mask.all,0xFF,sizeof(info_v1->mask.all));
+ ret = recent_mt_check(par,info_v1);
+
+ kfree(info_v1);
+ return(ret);
+}
+
+static int recent_mt_check_v1(const struct xt_mtchk_param *par)
+{
+ return(recent_mt_check(par,par->matchinfo));
+}
+
static void recent_mt_destroy(const struct xt_mtdtor_param *par)
{
struct recent_net *recent_net = recent_pernet(par->net);
- const struct xt_recent_mtinfo *info = par->matchinfo;
+ const struct xt_recent_mtinfo_v1 *info = par->matchinfo;
struct recent_table *t;
mutex_lock(&recent_mutex);
@@ -625,7 +659,7 @@
.family = NFPROTO_IPV4,
.match = recent_mt,
.matchsize = sizeof(struct xt_recent_mtinfo),
- .checkentry = recent_mt_check,
+ .checkentry = recent_mt_check_v0,
.destroy = recent_mt_destroy,
.me = THIS_MODULE,
},
@@ -635,10 +669,30 @@
.family = NFPROTO_IPV6,
.match = recent_mt,
.matchsize = sizeof(struct xt_recent_mtinfo),
- .checkentry = recent_mt_check,
+ .checkentry = recent_mt_check_v0,
.destroy = recent_mt_destroy,
.me = THIS_MODULE,
},
+ {
+ .name = "recent",
+ .revision = 1,
+ .family = NFPROTO_IPV4,
+ .match = recent_mt,
+ .matchsize = sizeof(struct xt_recent_mtinfo_v1),
+ .checkentry = recent_mt_check_v1,
+ .destroy = recent_mt_destroy,
+ .me = THIS_MODULE,
+ },
+ {
+ .name = "recent",
+ .revision = 1,
+ .family = NFPROTO_IPV6,
+ .match = recent_mt,
+ .matchsize = sizeof(struct xt_recent_mtinfo_v1),
+ .checkentry = recent_mt_check_v1,
+ .destroy = recent_mt_destroy,
+ .me = THIS_MODULE,
+ }
};
static int __init recent_mt_init(void)
