xt_recent.c 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Copyright (c) 2006 Patrick McHardy <kaber@trash.net>
  4. * Copyright © CC Computer Consultants GmbH, 2007 - 2008
  5. *
  6. * This is a replacement of the old ipt_recent module, which carried the
  7. * following copyright notice:
  8. *
  9. * Author: Stephen Frost <sfrost@snowman.net>
  10. * Copyright 2002-2003, Stephen Frost, 2.5.x port by laforge@netfilter.org
  11. */
  12. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  13. #include <linux/init.h>
  14. #include <linux/ip.h>
  15. #include <linux/ipv6.h>
  16. #include <linux/module.h>
  17. #include <linux/moduleparam.h>
  18. #include <linux/proc_fs.h>
  19. #include <linux/seq_file.h>
  20. #include <linux/string.h>
  21. #include <linux/ctype.h>
  22. #include <linux/list.h>
  23. #include <linux/random.h>
  24. #include <linux/jhash.h>
  25. #include <linux/bitops.h>
  26. #include <linux/skbuff.h>
  27. #include <linux/inet.h>
  28. #include <linux/slab.h>
  29. #include <linux/vmalloc.h>
  30. #include <net/net_namespace.h>
  31. #include <net/netns/generic.h>
  32. #include <linux/netfilter/x_tables.h>
  33. #include <linux/netfilter/xt_recent.h>
  34. MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
  35. MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
  36. MODULE_DESCRIPTION("Xtables: \"recently-seen\" host matching");
  37. MODULE_LICENSE("GPL");
  38. MODULE_ALIAS("ipt_recent");
  39. MODULE_ALIAS("ip6t_recent");
  40. static unsigned int ip_list_tot __read_mostly = 100;
  41. static unsigned int ip_list_hash_size __read_mostly;
  42. static unsigned int ip_list_perms __read_mostly = 0644;
  43. static unsigned int ip_list_uid __read_mostly;
  44. static unsigned int ip_list_gid __read_mostly;
  45. module_param(ip_list_tot, uint, 0400);
  46. module_param(ip_list_hash_size, uint, 0400);
  47. module_param(ip_list_perms, uint, 0400);
  48. module_param(ip_list_uid, uint, 0644);
  49. module_param(ip_list_gid, uint, 0644);
  50. MODULE_PARM_DESC(ip_list_tot, "number of IPs to remember per list");
  51. MODULE_PARM_DESC(ip_list_hash_size, "size of hash table used to look up IPs");
  52. MODULE_PARM_DESC(ip_list_perms, "permissions on /proc/net/xt_recent/* files");
  53. MODULE_PARM_DESC(ip_list_uid, "default owner of /proc/net/xt_recent/* files");
  54. MODULE_PARM_DESC(ip_list_gid, "default owning group of /proc/net/xt_recent/* files");
  55. /* retained for backwards compatibility */
  56. static unsigned int ip_pkt_list_tot __read_mostly;
  57. module_param(ip_pkt_list_tot, uint, 0400);
  58. MODULE_PARM_DESC(ip_pkt_list_tot, "number of packets per IP address to remember (max. 255)");
  59. #define XT_RECENT_MAX_NSTAMPS 256
  60. struct recent_entry {
  61. struct list_head list;
  62. struct list_head lru_list;
  63. union nf_inet_addr addr;
  64. u_int16_t family;
  65. u_int8_t ttl;
  66. u_int8_t index;
  67. u_int16_t nstamps;
  68. unsigned long stamps[];
  69. };
  70. struct recent_table {
  71. struct list_head list;
  72. char name[XT_RECENT_NAME_LEN];
  73. union nf_inet_addr mask;
  74. unsigned int refcnt;
  75. unsigned int entries;
  76. u8 nstamps_max_mask;
  77. struct list_head lru_list;
  78. struct list_head iphash[];
  79. };
  80. struct recent_net {
  81. struct list_head tables;
  82. #ifdef CONFIG_PROC_FS
  83. struct proc_dir_entry *xt_recent;
  84. #endif
  85. };
  86. static unsigned int recent_net_id __read_mostly;
  87. static inline struct recent_net *recent_pernet(struct net *net)
  88. {
  89. return net_generic(net, recent_net_id);
  90. }
  91. static DEFINE_SPINLOCK(recent_lock);
  92. static DEFINE_MUTEX(recent_mutex);
  93. #ifdef CONFIG_PROC_FS
  94. static const struct proc_ops recent_mt_proc_ops;
  95. #endif
  96. static u_int32_t hash_rnd __read_mostly;
  97. static inline unsigned int recent_entry_hash4(const union nf_inet_addr *addr)
  98. {
  99. return jhash_1word((__force u32)addr->ip, hash_rnd) &
  100. (ip_list_hash_size - 1);
  101. }
  102. static inline unsigned int recent_entry_hash6(const union nf_inet_addr *addr)
  103. {
  104. return jhash2((u32 *)addr->ip6, ARRAY_SIZE(addr->ip6), hash_rnd) &
  105. (ip_list_hash_size - 1);
  106. }
  107. static struct recent_entry *
  108. recent_entry_lookup(const struct recent_table *table,
  109. const union nf_inet_addr *addrp, u_int16_t family,
  110. u_int8_t ttl)
  111. {
  112. struct recent_entry *e;
  113. unsigned int h;
  114. if (family == NFPROTO_IPV4)
  115. h = recent_entry_hash4(addrp);
  116. else
  117. h = recent_entry_hash6(addrp);
  118. list_for_each_entry(e, &table->iphash[h], list)
  119. if (e->family == family &&
  120. memcmp(&e->addr, addrp, sizeof(e->addr)) == 0 &&
  121. (ttl == e->ttl || ttl == 0 || e->ttl == 0))
  122. return e;
  123. return NULL;
  124. }
  125. static void recent_entry_remove(struct recent_table *t, struct recent_entry *e)
  126. {
  127. list_del(&e->list);
  128. list_del(&e->lru_list);
  129. kfree(e);
  130. t->entries--;
  131. }
  132. /*
  133. * Drop entries with timestamps older then 'time'.
  134. */
  135. static void recent_entry_reap(struct recent_table *t, unsigned long time,
  136. struct recent_entry *working, bool update)
  137. {
  138. struct recent_entry *e;
  139. /*
  140. * The head of the LRU list is always the oldest entry.
  141. */
  142. e = list_entry(t->lru_list.next, struct recent_entry, lru_list);
  143. /*
  144. * Do not reap the entry which are going to be updated.
  145. */
  146. if (e == working && update)
  147. return;
  148. /*
  149. * The last time stamp is the most recent.
  150. */
  151. if (time_after(time, e->stamps[e->index-1]))
  152. recent_entry_remove(t, e);
  153. }
  154. static struct recent_entry *
  155. recent_entry_init(struct recent_table *t, const union nf_inet_addr *addr,
  156. u_int16_t family, u_int8_t ttl)
  157. {
  158. struct recent_entry *e;
  159. unsigned int nstamps_max = t->nstamps_max_mask;
  160. if (t->entries >= ip_list_tot) {
  161. e = list_entry(t->lru_list.next, struct recent_entry, lru_list);
  162. recent_entry_remove(t, e);
  163. }
  164. nstamps_max += 1;
  165. e = kmalloc(struct_size(e, stamps, nstamps_max), GFP_ATOMIC);
  166. if (e == NULL)
  167. return NULL;
  168. memcpy(&e->addr, addr, sizeof(e->addr));
  169. e->ttl = ttl;
  170. e->stamps[0] = jiffies;
  171. e->nstamps = 1;
  172. e->index = 1;
  173. e->family = family;
  174. if (family == NFPROTO_IPV4)
  175. list_add_tail(&e->list, &t->iphash[recent_entry_hash4(addr)]);
  176. else
  177. list_add_tail(&e->list, &t->iphash[recent_entry_hash6(addr)]);
  178. list_add_tail(&e->lru_list, &t->lru_list);
  179. t->entries++;
  180. return e;
  181. }
  182. static void recent_entry_update(struct recent_table *t, struct recent_entry *e)
  183. {
  184. e->index &= t->nstamps_max_mask;
  185. e->stamps[e->index++] = jiffies;
  186. if (e->index > e->nstamps)
  187. e->nstamps = e->index;
  188. list_move_tail(&e->lru_list, &t->lru_list);
  189. }
  190. static struct recent_table *recent_table_lookup(struct recent_net *recent_net,
  191. const char *name)
  192. {
  193. struct recent_table *t;
  194. list_for_each_entry(t, &recent_net->tables, list)
  195. if (!strcmp(t->name, name))
  196. return t;
  197. return NULL;
  198. }
  199. static void recent_table_flush(struct recent_table *t)
  200. {
  201. struct recent_entry *e, *next;
  202. unsigned int i;
  203. for (i = 0; i < ip_list_hash_size; i++)
  204. list_for_each_entry_safe(e, next, &t->iphash[i], list)
  205. recent_entry_remove(t, e);
  206. }
  207. static bool
  208. recent_mt(const struct sk_buff *skb, struct xt_action_param *par)
  209. {
  210. struct net *net = xt_net(par);
  211. struct recent_net *recent_net = recent_pernet(net);
  212. const struct xt_recent_mtinfo_v1 *info = par->matchinfo;
  213. struct recent_table *t;
  214. struct recent_entry *e;
  215. union nf_inet_addr addr = {}, addr_mask;
  216. u_int8_t ttl;
  217. bool ret = info->invert;
  218. if (xt_family(par) == NFPROTO_IPV4) {
  219. const struct iphdr *iph = ip_hdr(skb);
  220. if (info->side == XT_RECENT_DEST)
  221. addr.ip = iph->daddr;
  222. else
  223. addr.ip = iph->saddr;
  224. ttl = iph->ttl;
  225. } else {
  226. const struct ipv6hdr *iph = ipv6_hdr(skb);
  227. if (info->side == XT_RECENT_DEST)
  228. memcpy(&addr.in6, &iph->daddr, sizeof(addr.in6));
  229. else
  230. memcpy(&addr.in6, &iph->saddr, sizeof(addr.in6));
  231. ttl = iph->hop_limit;
  232. }
  233. /* use TTL as seen before forwarding */
  234. if (xt_out(par) != NULL &&
  235. (!skb->sk || !net_eq(net, sock_net(skb->sk))))
  236. ttl++;
  237. spin_lock_bh(&recent_lock);
  238. t = recent_table_lookup(recent_net, info->name);
  239. nf_inet_addr_mask(&addr, &addr_mask, &t->mask);
  240. e = recent_entry_lookup(t, &addr_mask, xt_family(par),
  241. (info->check_set & XT_RECENT_TTL) ? ttl : 0);
  242. if (e == NULL) {
  243. if (!(info->check_set & XT_RECENT_SET))
  244. goto out;
  245. e = recent_entry_init(t, &addr_mask, xt_family(par), ttl);
  246. if (e == NULL)
  247. par->hotdrop = true;
  248. ret = !ret;
  249. goto out;
  250. }
  251. if (info->check_set & XT_RECENT_SET)
  252. ret = !ret;
  253. else if (info->check_set & XT_RECENT_REMOVE) {
  254. recent_entry_remove(t, e);
  255. ret = !ret;
  256. } else if (info->check_set & (XT_RECENT_CHECK | XT_RECENT_UPDATE)) {
  257. unsigned long time = jiffies - info->seconds * HZ;
  258. unsigned int i, hits = 0;
  259. for (i = 0; i < e->nstamps; i++) {
  260. if (info->seconds && time_after(time, e->stamps[i]))
  261. continue;
  262. if (!info->hit_count || ++hits >= info->hit_count) {
  263. ret = !ret;
  264. break;
  265. }
  266. }
  267. /* info->seconds must be non-zero */
  268. if (info->check_set & XT_RECENT_REAP)
  269. recent_entry_reap(t, time, e,
  270. info->check_set & XT_RECENT_UPDATE && ret);
  271. }
  272. if (info->check_set & XT_RECENT_SET ||
  273. (info->check_set & XT_RECENT_UPDATE && ret)) {
  274. recent_entry_update(t, e);
  275. e->ttl = ttl;
  276. }
  277. out:
  278. spin_unlock_bh(&recent_lock);
  279. return ret;
  280. }
  281. static void recent_table_free(void *addr)
  282. {
  283. kvfree(addr);
  284. }
  285. static int recent_mt_check(const struct xt_mtchk_param *par,
  286. const struct xt_recent_mtinfo_v1 *info)
  287. {
  288. struct recent_net *recent_net = recent_pernet(par->net);
  289. struct recent_table *t;
  290. #ifdef CONFIG_PROC_FS
  291. struct proc_dir_entry *pde;
  292. kuid_t uid;
  293. kgid_t gid;
  294. #endif
  295. unsigned int nstamp_mask;
  296. unsigned int i;
  297. int ret = -EINVAL;
  298. net_get_random_once(&hash_rnd, sizeof(hash_rnd));
  299. if (info->check_set & ~XT_RECENT_VALID_FLAGS) {
  300. pr_info_ratelimited("Unsupported userspace flags (%08x)\n",
  301. info->check_set);
  302. return -EINVAL;
  303. }
  304. if (hweight8(info->check_set &
  305. (XT_RECENT_SET | XT_RECENT_REMOVE |
  306. XT_RECENT_CHECK | XT_RECENT_UPDATE)) != 1)
  307. return -EINVAL;
  308. if ((info->check_set & (XT_RECENT_SET | XT_RECENT_REMOVE)) &&
  309. (info->seconds || info->hit_count ||
  310. (info->check_set & XT_RECENT_MODIFIERS)))
  311. return -EINVAL;
  312. if ((info->check_set & XT_RECENT_REAP) && !info->seconds)
  313. return -EINVAL;
  314. if (info->hit_count >= XT_RECENT_MAX_NSTAMPS) {
  315. pr_info_ratelimited("hitcount (%u) is larger than allowed maximum (%u)\n",
  316. info->hit_count, XT_RECENT_MAX_NSTAMPS - 1);
  317. return -EINVAL;
  318. }
  319. ret = xt_check_proc_name(info->name, sizeof(info->name));
  320. if (ret)
  321. return ret;
  322. if (ip_pkt_list_tot && info->hit_count < ip_pkt_list_tot)
  323. nstamp_mask = roundup_pow_of_two(ip_pkt_list_tot) - 1;
  324. else if (info->hit_count)
  325. nstamp_mask = roundup_pow_of_two(info->hit_count) - 1;
  326. else
  327. nstamp_mask = 32 - 1;
  328. mutex_lock(&recent_mutex);
  329. t = recent_table_lookup(recent_net, info->name);
  330. if (t != NULL) {
  331. if (nstamp_mask > t->nstamps_max_mask) {
  332. spin_lock_bh(&recent_lock);
  333. recent_table_flush(t);
  334. t->nstamps_max_mask = nstamp_mask;
  335. spin_unlock_bh(&recent_lock);
  336. }
  337. t->refcnt++;
  338. ret = 0;
  339. goto out;
  340. }
  341. t = kvzalloc(struct_size(t, iphash, ip_list_hash_size), GFP_KERNEL);
  342. if (t == NULL) {
  343. ret = -ENOMEM;
  344. goto out;
  345. }
  346. t->refcnt = 1;
  347. t->nstamps_max_mask = nstamp_mask;
  348. memcpy(&t->mask, &info->mask, sizeof(t->mask));
  349. strcpy(t->name, info->name);
  350. INIT_LIST_HEAD(&t->lru_list);
  351. for (i = 0; i < ip_list_hash_size; i++)
  352. INIT_LIST_HEAD(&t->iphash[i]);
  353. #ifdef CONFIG_PROC_FS
  354. uid = make_kuid(&init_user_ns, ip_list_uid);
  355. gid = make_kgid(&init_user_ns, ip_list_gid);
  356. if (!uid_valid(uid) || !gid_valid(gid)) {
  357. recent_table_free(t);
  358. ret = -EINVAL;
  359. goto out;
  360. }
  361. pde = proc_create_data(t->name, ip_list_perms, recent_net->xt_recent,
  362. &recent_mt_proc_ops, t);
  363. if (pde == NULL) {
  364. recent_table_free(t);
  365. ret = -ENOMEM;
  366. goto out;
  367. }
  368. proc_set_user(pde, uid, gid);
  369. #endif
  370. spin_lock_bh(&recent_lock);
  371. list_add_tail(&t->list, &recent_net->tables);
  372. spin_unlock_bh(&recent_lock);
  373. ret = 0;
  374. out:
  375. mutex_unlock(&recent_mutex);
  376. return ret;
  377. }
  378. static int recent_mt_check_v0(const struct xt_mtchk_param *par)
  379. {
  380. const struct xt_recent_mtinfo_v0 *info_v0 = par->matchinfo;
  381. struct xt_recent_mtinfo_v1 info_v1;
  382. /* Copy revision 0 structure to revision 1 */
  383. memcpy(&info_v1, info_v0, sizeof(struct xt_recent_mtinfo));
  384. /* Set default mask to ensure backward compatible behaviour */
  385. memset(info_v1.mask.all, 0xFF, sizeof(info_v1.mask.all));
  386. return recent_mt_check(par, &info_v1);
  387. }
  388. static int recent_mt_check_v1(const struct xt_mtchk_param *par)
  389. {
  390. return recent_mt_check(par, par->matchinfo);
  391. }
  392. static void recent_mt_destroy(const struct xt_mtdtor_param *par)
  393. {
  394. struct recent_net *recent_net = recent_pernet(par->net);
  395. const struct xt_recent_mtinfo_v1 *info = par->matchinfo;
  396. struct recent_table *t;
  397. mutex_lock(&recent_mutex);
  398. t = recent_table_lookup(recent_net, info->name);
  399. if (--t->refcnt == 0) {
  400. spin_lock_bh(&recent_lock);
  401. list_del(&t->list);
  402. spin_unlock_bh(&recent_lock);
  403. #ifdef CONFIG_PROC_FS
  404. if (recent_net->xt_recent != NULL)
  405. remove_proc_entry(t->name, recent_net->xt_recent);
  406. #endif
  407. recent_table_flush(t);
  408. recent_table_free(t);
  409. }
  410. mutex_unlock(&recent_mutex);
  411. }
  412. #ifdef CONFIG_PROC_FS
  413. struct recent_iter_state {
  414. const struct recent_table *table;
  415. unsigned int bucket;
  416. };
  417. static void *recent_seq_start(struct seq_file *seq, loff_t *pos)
  418. __acquires(recent_lock)
  419. {
  420. struct recent_iter_state *st = seq->private;
  421. const struct recent_table *t = st->table;
  422. struct recent_entry *e;
  423. loff_t p = *pos;
  424. spin_lock_bh(&recent_lock);
  425. for (st->bucket = 0; st->bucket < ip_list_hash_size; st->bucket++)
  426. list_for_each_entry(e, &t->iphash[st->bucket], list)
  427. if (p-- == 0)
  428. return e;
  429. return NULL;
  430. }
  431. static void *recent_seq_next(struct seq_file *seq, void *v, loff_t *pos)
  432. {
  433. struct recent_iter_state *st = seq->private;
  434. const struct recent_table *t = st->table;
  435. const struct recent_entry *e = v;
  436. const struct list_head *head = e->list.next;
  437. (*pos)++;
  438. while (head == &t->iphash[st->bucket]) {
  439. if (++st->bucket >= ip_list_hash_size)
  440. return NULL;
  441. head = t->iphash[st->bucket].next;
  442. }
  443. return list_entry(head, struct recent_entry, list);
  444. }
  445. static void recent_seq_stop(struct seq_file *s, void *v)
  446. __releases(recent_lock)
  447. {
  448. spin_unlock_bh(&recent_lock);
  449. }
  450. static int recent_seq_show(struct seq_file *seq, void *v)
  451. {
  452. const struct recent_entry *e = v;
  453. struct recent_iter_state *st = seq->private;
  454. const struct recent_table *t = st->table;
  455. unsigned int i;
  456. i = (e->index - 1) & t->nstamps_max_mask;
  457. if (e->family == NFPROTO_IPV4)
  458. seq_printf(seq, "src=%pI4 ttl: %u last_seen: %lu oldest_pkt: %u",
  459. &e->addr.ip, e->ttl, e->stamps[i], e->index);
  460. else
  461. seq_printf(seq, "src=%pI6 ttl: %u last_seen: %lu oldest_pkt: %u",
  462. &e->addr.in6, e->ttl, e->stamps[i], e->index);
  463. for (i = 0; i < e->nstamps; i++)
  464. seq_printf(seq, "%s %lu", i ? "," : "", e->stamps[i]);
  465. seq_putc(seq, '\n');
  466. return 0;
  467. }
  468. static const struct seq_operations recent_seq_ops = {
  469. .start = recent_seq_start,
  470. .next = recent_seq_next,
  471. .stop = recent_seq_stop,
  472. .show = recent_seq_show,
  473. };
  474. static int recent_seq_open(struct inode *inode, struct file *file)
  475. {
  476. struct recent_iter_state *st;
  477. st = __seq_open_private(file, &recent_seq_ops, sizeof(*st));
  478. if (st == NULL)
  479. return -ENOMEM;
  480. st->table = PDE_DATA(inode);
  481. return 0;
  482. }
  483. static ssize_t
  484. recent_mt_proc_write(struct file *file, const char __user *input,
  485. size_t size, loff_t *loff)
  486. {
  487. struct recent_table *t = PDE_DATA(file_inode(file));
  488. struct recent_entry *e;
  489. char buf[sizeof("+b335:1d35:1e55:dead:c0de:1715:5afe:c0de")];
  490. const char *c = buf;
  491. union nf_inet_addr addr = {};
  492. u_int16_t family;
  493. bool add, succ;
  494. if (size == 0)
  495. return 0;
  496. if (size > sizeof(buf))
  497. size = sizeof(buf);
  498. if (copy_from_user(buf, input, size) != 0)
  499. return -EFAULT;
  500. /* Strict protocol! */
  501. if (*loff != 0)
  502. return -ESPIPE;
  503. switch (*c) {
  504. case '/': /* flush table */
  505. spin_lock_bh(&recent_lock);
  506. recent_table_flush(t);
  507. spin_unlock_bh(&recent_lock);
  508. return size;
  509. case '-': /* remove address */
  510. add = false;
  511. break;
  512. case '+': /* add address */
  513. add = true;
  514. break;
  515. default:
  516. pr_info_ratelimited("Need \"+ip\", \"-ip\" or \"/\"\n");
  517. return -EINVAL;
  518. }
  519. ++c;
  520. --size;
  521. if (strnchr(c, size, ':') != NULL) {
  522. family = NFPROTO_IPV6;
  523. succ = in6_pton(c, size, (void *)&addr, '\n', NULL);
  524. } else {
  525. family = NFPROTO_IPV4;
  526. succ = in4_pton(c, size, (void *)&addr, '\n', NULL);
  527. }
  528. if (!succ)
  529. return -EINVAL;
  530. spin_lock_bh(&recent_lock);
  531. e = recent_entry_lookup(t, &addr, family, 0);
  532. if (e == NULL) {
  533. if (add)
  534. recent_entry_init(t, &addr, family, 0);
  535. } else {
  536. if (add)
  537. recent_entry_update(t, e);
  538. else
  539. recent_entry_remove(t, e);
  540. }
  541. spin_unlock_bh(&recent_lock);
  542. /* Note we removed one above */
  543. *loff += size + 1;
  544. return size + 1;
  545. }
  546. static const struct proc_ops recent_mt_proc_ops = {
  547. .proc_open = recent_seq_open,
  548. .proc_read = seq_read,
  549. .proc_write = recent_mt_proc_write,
  550. .proc_release = seq_release_private,
  551. .proc_lseek = seq_lseek,
  552. };
  553. static int __net_init recent_proc_net_init(struct net *net)
  554. {
  555. struct recent_net *recent_net = recent_pernet(net);
  556. recent_net->xt_recent = proc_mkdir("xt_recent", net->proc_net);
  557. if (!recent_net->xt_recent)
  558. return -ENOMEM;
  559. return 0;
  560. }
  561. static void __net_exit recent_proc_net_exit(struct net *net)
  562. {
  563. struct recent_net *recent_net = recent_pernet(net);
  564. struct recent_table *t;
  565. /* recent_net_exit() is called before recent_mt_destroy(). Make sure
  566. * that the parent xt_recent proc entry is empty before trying to
  567. * remove it.
  568. */
  569. spin_lock_bh(&recent_lock);
  570. list_for_each_entry(t, &recent_net->tables, list)
  571. remove_proc_entry(t->name, recent_net->xt_recent);
  572. recent_net->xt_recent = NULL;
  573. spin_unlock_bh(&recent_lock);
  574. remove_proc_entry("xt_recent", net->proc_net);
  575. }
  576. #else
  577. static inline int recent_proc_net_init(struct net *net)
  578. {
  579. return 0;
  580. }
  581. static inline void recent_proc_net_exit(struct net *net)
  582. {
  583. }
  584. #endif /* CONFIG_PROC_FS */
  585. static int __net_init recent_net_init(struct net *net)
  586. {
  587. struct recent_net *recent_net = recent_pernet(net);
  588. INIT_LIST_HEAD(&recent_net->tables);
  589. return recent_proc_net_init(net);
  590. }
  591. static void __net_exit recent_net_exit(struct net *net)
  592. {
  593. recent_proc_net_exit(net);
  594. }
  595. static struct pernet_operations recent_net_ops = {
  596. .init = recent_net_init,
  597. .exit = recent_net_exit,
  598. .id = &recent_net_id,
  599. .size = sizeof(struct recent_net),
  600. };
  601. static struct xt_match recent_mt_reg[] __read_mostly = {
  602. {
  603. .name = "recent",
  604. .revision = 0,
  605. .family = NFPROTO_IPV4,
  606. .match = recent_mt,
  607. .matchsize = sizeof(struct xt_recent_mtinfo),
  608. .checkentry = recent_mt_check_v0,
  609. .destroy = recent_mt_destroy,
  610. .me = THIS_MODULE,
  611. },
  612. {
  613. .name = "recent",
  614. .revision = 0,
  615. .family = NFPROTO_IPV6,
  616. .match = recent_mt,
  617. .matchsize = sizeof(struct xt_recent_mtinfo),
  618. .checkentry = recent_mt_check_v0,
  619. .destroy = recent_mt_destroy,
  620. .me = THIS_MODULE,
  621. },
  622. {
  623. .name = "recent",
  624. .revision = 1,
  625. .family = NFPROTO_IPV4,
  626. .match = recent_mt,
  627. .matchsize = sizeof(struct xt_recent_mtinfo_v1),
  628. .checkentry = recent_mt_check_v1,
  629. .destroy = recent_mt_destroy,
  630. .me = THIS_MODULE,
  631. },
  632. {
  633. .name = "recent",
  634. .revision = 1,
  635. .family = NFPROTO_IPV6,
  636. .match = recent_mt,
  637. .matchsize = sizeof(struct xt_recent_mtinfo_v1),
  638. .checkentry = recent_mt_check_v1,
  639. .destroy = recent_mt_destroy,
  640. .me = THIS_MODULE,
  641. }
  642. };
  643. static int __init recent_mt_init(void)
  644. {
  645. int err;
  646. BUILD_BUG_ON_NOT_POWER_OF_2(XT_RECENT_MAX_NSTAMPS);
  647. if (!ip_list_tot || ip_pkt_list_tot >= XT_RECENT_MAX_NSTAMPS)
  648. return -EINVAL;
  649. ip_list_hash_size = 1 << fls(ip_list_tot);
  650. err = register_pernet_subsys(&recent_net_ops);
  651. if (err)
  652. return err;
  653. err = xt_register_matches(recent_mt_reg, ARRAY_SIZE(recent_mt_reg));
  654. if (err)
  655. unregister_pernet_subsys(&recent_net_ops);
  656. return err;
  657. }
  658. static void __exit recent_mt_exit(void)
  659. {
  660. xt_unregister_matches(recent_mt_reg, ARRAY_SIZE(recent_mt_reg));
  661. unregister_pernet_subsys(&recent_net_ops);
  662. }
  663. module_init(recent_mt_init);
  664. module_exit(recent_mt_exit);