Replying to auther_bin:
> And it tells me: Hunk #1 FAILED at 1.
> 1 out of 1 hunk failed........
# This is a BitKeeper generated patch for the following project:
# Project Name: Linux kernel tree
# This patch format is intended for GNU patch command version 2.5 or higher.
# This patch includes the following deltas:
# ChangeSet 1.325 -> 1.326
# net/ipv4/netfilter/Makefile 1.13 -> 1.14
# net/ipv4/netfilter/ip_conntrack_standalone.c 1.8 -> 1.9
# net/ipv4/netfilter/Config.in 1.14 -> 1.15
# Documentation/Configure.help 1.97 -> 1.98
# (new) -> 1.1
include/linux/netfilter_ipv4/ipt_iplimit.h
# (new) -> 1.1 net/ipv4/netfilter/ipt_iplimit.c
#
# The following is the BitKeeper ChangeSet Log
# --------------------------------------------
# 02/04/17 [EMAIL PROTECTED] 1.326
# The base/iplimit patch:
# Author: Gerd Knorr <[EMAIL PROTECTED]>
# Status: ItWorksForMe[tm]
#
# This adds CONFIG_IP_NF_MATCH_IPLIMIT match allows you to restrict the
# number of parallel TCP connections to a server per client IP address
# (or address block).
#
# Examples:
#
# # allow 2 telnet connections per client host
# iptables -p tcp --syn --dport 23 -m iplimit --iplimit-above 2 -j REJECT
#
# # you can also match the other way around:
# iptables -p tcp --syn --dport 23 -m iplimit ! --iplimit-above 2 -j ACCEPT
#
# # limit the nr of parallel http requests to 16 per class C sized
# # network (24 bit netmask)
# iptables -p tcp --syn --dport 80 -m iplimit --iplimit-above 16
--iplimit-mask 24 -j REJECT
# --------------------------------------------
#
diff -Nru a/Documentation/Configure.help b/Documentation/Configure.help
--- a/Documentation/Configure.help Thu Apr 18 11:42:51 2002
+++ b/Documentation/Configure.help Thu Apr 18 11:42:52 2002
@@ -2593,6 +2593,14 @@
If you want to compile it as a module, say M here and read
Documentation/modules.txt. If unsure, say `N'.
+Connections/IP limit match support
+CONFIG_IP_NF_MATCH_IPLIMIT
+ This match allows you to restrict the number of parallel TCP
+ connections to a server per client IP address (or address block).
+
+ If you want to compile it as a module, say M here and read
+ Documentation/modules.txt. If unsure, say `N'.
+
Connection state match support
CONFIG_IP_NF_MATCH_STATE
diff -Nru a/include/linux/netfilter_ipv4/ipt_iplimit.h
b/include/linux/netfilter_ipv4/ipt_iplimit.h
--- /dev/null Wed Dec 31 16:00:00 1969
+++ b/include/linux/netfilter_ipv4/ipt_iplimit.h Thu Apr 18 11:42:52 2002
@@ -0,0 +1,12 @@
+#ifndef _IPT_IPLIMIT_H
+#define _IPT_IPLIMIT_H
+
+struct ipt_iplimit_data;
+
+struct ipt_iplimit_info {
+ int limit;
+ int inverse;
+ u_int32_t mask;
+ struct ipt_iplimit_data *data;
+};
+#endif /* _IPT_IPLIMIT_H */
diff -Nru a/net/ipv4/netfilter/Config.in b/net/ipv4/netfilter/Config.in
--- a/net/ipv4/netfilter/Config.in Thu Apr 18 11:42:51 2002
+++ b/net/ipv4/netfilter/Config.in Thu Apr 18 11:42:51 2002
@@ -30,6 +30,7 @@
dep_tristate ' tcpmss match support' CONFIG_IP_NF_MATCH_TCPMSS
$CONFIG_IP_NF_IPTABLES
if [ "$CONFIG_IP_NF_CONNTRACK" != "n" ]; then
dep_tristate ' Connection state match support' CONFIG_IP_NF_MATCH_STATE
$CONFIG_IP_NF_CONNTRACK $CONFIG_IP_NF_IPTABLES
+ dep_tristate ' Connections/IP limit match support' CONFIG_IP_NF_MATCH_IPLIMIT
+$CONFIG_IP_NF_IPTABLES
dep_tristate ' Connection tracking match support' CONFIG_IP_NF_MATCH_CONNTRACK
$CONFIG_IP_NF_CONNTRACK $CONFIG_IP_NF_IPTABLES
fi
if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
diff -Nru a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
--- a/net/ipv4/netfilter/Makefile Thu Apr 18 11:42:51 2002
+++ b/net/ipv4/netfilter/Makefile Thu Apr 18 11:42:51 2002
@@ -70,6 +70,7 @@
obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
+obj-$(CONFIG_IP_NF_MATCH_IPLIMIT) += ipt_iplimit.o
obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
obj-$(CONFIG_IP_NF_MATCH_UNCLEAN) += ipt_unclean.o
obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
diff -Nru a/net/ipv4/netfilter/ip_conntrack_standalone.c
b/net/ipv4/netfilter/ip_conntrack_standalone.c
--- a/net/ipv4/netfilter/ip_conntrack_standalone.c Thu Apr 18 11:42:51 2002
+++ b/net/ipv4/netfilter/ip_conntrack_standalone.c Thu Apr 18 11:42:51 2002
@@ -361,6 +361,7 @@
EXPORT_SYMBOL(ip_ct_refresh);
EXPORT_SYMBOL(ip_ct_find_proto);
EXPORT_SYMBOL(ip_ct_find_helper);
+EXPORT_SYMBOL(ip_conntrack_find_get);
EXPORT_SYMBOL(ip_conntrack_expect_related);
EXPORT_SYMBOL(ip_conntrack_change_expect);
EXPORT_SYMBOL(ip_conntrack_unexpect_related);
diff -Nru a/net/ipv4/netfilter/ipt_iplimit.c b/net/ipv4/netfilter/ipt_iplimit.c
--- /dev/null Wed Dec 31 16:00:00 1969
+++ b/net/ipv4/netfilter/ipt_iplimit.c Thu Apr 18 11:42:52 2002
@@ -0,0 +1,228 @@
+/*
+ * netfilter module to limit the number of parallel tcp
+ * connections per IP address.
+ * (c) 2000 Gerd Knorr <[EMAIL PROTECTED]>
+ *
+ * based on ...
+ *
+ * Kernel module to match connection tracking information.
+ * GPL (C) 1999 Rusty Russell ([EMAIL PROTECTED]).
+ */
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/list.h>
+#include <linux/netfilter_ipv4/ip_conntrack.h>
+#include <linux/netfilter_ipv4/ip_conntrack_core.h>
+#include <linux/netfilter_ipv4/ip_conntrack_tcp.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_iplimit.h>
+
+#define DEBUG 0
+
+MODULE_LICENSE("GPL");
+
+/* we'll save the tuples of all connections we care about */
+struct ipt_iplimit_conn
+{
+ struct list_head list;
+ struct ip_conntrack_tuple tuple;
+};
+
+struct ipt_iplimit_data {
+ spinlock_t lock;
+ struct list_head iphash[256];
+};
+
+static int ipt_iphash(u_int32_t addr)
+{
+ int hash;
+
+ hash = addr & 0xff;
+ hash ^= (addr >> 8) & 0xff;
+ hash ^= (addr >> 16) & 0xff;
+ hash ^= (addr >> 24) & 0xff;
+ return hash;
+}
+
+static int count_them(struct ipt_iplimit_data *data,
+ u_int32_t addr, u_int32_t mask,
+ struct ip_conntrack *ct)
+{
+#if DEBUG
+ const static char *tcp[] = { "none", "established", "syn_sent", "syn_recv",
+ "fin_wait", "time_wait", "close", "close_wait",
+ "last_ack", "listen" };
+#endif
+ int addit = 1, matches = 0;
+ struct ip_conntrack_tuple tuple;
+ struct ip_conntrack_tuple_hash *found;
+ struct ipt_iplimit_conn *conn;
+ struct list_head *hash,*lh;
+
+ spin_lock(&data->lock);
+ tuple = ct->tuplehash[0].tuple;
+ hash = &data->iphash[ipt_iphash(addr & mask)];
+
+ /* check the saved connections */
+ for (lh = hash->next; lh != hash; lh = lh->next) {
+ conn = list_entry(lh,struct ipt_iplimit_conn,list);
+ if (0 == memcmp(&conn->tuple,&tuple,sizeof(tuple))) {
+ /* Just to be sure we have it only once in the list.
+ We should'nt see tuples twice unless someone hooks this
+ into a table without "-p tcp --syn" */
+ addit = 0;
+ }
+ found = ip_conntrack_find_get(&conn->tuple,ct);
+#if DEBUG
+ printk("ipt_iplimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d %s\n",
+ ipt_iphash(addr & mask),
+ NIPQUAD(conn->tuple.src.ip), ntohs(conn->tuple.src.u.tcp.port),
+ NIPQUAD(conn->tuple.dst.ip), ntohs(conn->tuple.dst.u.tcp.port),
+ (NULL != found) ? tcp[found->ctrack->proto.tcp.state] : "gone");
+#endif
+ if (NULL == found) {
+ /* this one is gone */
+ lh = lh->prev;
+ list_del(lh->next);
+ kfree(conn);
+ continue;
+ }
+ if (found->ctrack->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT) {
+ /* we don't care about connections which are
+ closed already -> ditch it */
+ lh = lh->prev;
+ list_del(lh->next);
+ kfree(conn);
+ nf_conntrack_put(&found->ctrack->infos[0]);
+ continue;
+ }
+ if ((addr & mask) == (conn->tuple.src.ip & mask)) {
+ /* same source IP address -> be counted! */
+ matches++;
+ }
+ nf_conntrack_put(&found->ctrack->infos[0]);
+ }
+ if (addit) {
+ /* save the new connection in our list */
+#if DEBUG
+ printk("ipt_iplimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d new\n",
+ ipt_iphash(addr & mask),
+ NIPQUAD(tuple.src.ip), ntohs(tuple.src.u.tcp.port),
+ NIPQUAD(tuple.dst.ip), ntohs(tuple.dst.u.tcp.port));
+#endif
+ conn = kmalloc(sizeof(*conn),GFP_ATOMIC);
+ if (NULL == conn)
+ return -1;
+ memset(conn,0,sizeof(*conn));
+ INIT_LIST_HEAD(&conn->list);
+ conn->tuple = tuple;
+ list_add(&conn->list,hash);
+ matches++;
+ }
+ spin_unlock(&data->lock);
+ return matches;
+}
+
+static int
+match(const struct sk_buff *skb,
+ const struct net_device *in,
+ const struct net_device *out,
+ const void *matchinfo,
+ int offset,
+ const void *hdr,
+ u_int16_t datalen,
+ int *hotdrop)
+{
+ const struct ipt_iplimit_info *info = matchinfo;
+ int connections, match;
+ struct ip_conntrack *ct;
+ enum ip_conntrack_info ctinfo;
+
+ ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
+ if (NULL == ct) {
+ printk("ipt_iplimit: Oops: invalid ct state ?\n");
+ *hotdrop = 1;
+ return 0;
+ }
+ connections = count_them(info->data,skb->nh.iph->saddr,info->mask,ct);
+ if (-1 == connections) {
+ printk("ipt_iplimit: Hmm, kmalloc failed :-(\n");
+ *hotdrop = 1; /* let's free some memory :-) */
+ return 0;
+ }
+ match = (info->inverse) ? (connections <= info->limit) : (connections >
+info->limit);
+#if DEBUG
+ printk("ipt_iplimit: src=%u.%u.%u.%u mask=%u.%u.%u.%u "
+ "connections=%d limit=%d match=%s\n",
+ NIPQUAD(skb->nh.iph->saddr), NIPQUAD(info->mask),
+ connections, info->limit, match ? "yes" : "no");
+#endif
+
+ return match;
+}
+
+static int check(const char *tablename,
+ const struct ipt_ip *ip,
+ void *matchinfo,
+ unsigned int matchsize,
+ unsigned int hook_mask)
+{
+ struct ipt_iplimit_info *info = matchinfo;
+ int i;
+
+ /* verify size */
+ if (matchsize != IPT_ALIGN(sizeof(struct ipt_iplimit_info)))
+ return 0;
+
+ /* refuse anything but tcp */
+ if (ip->proto != IPPROTO_TCP)
+ return 0;
+
+ /* init private data */
+ info->data = kmalloc(sizeof(struct ipt_iplimit_data),GFP_KERNEL);
+ spin_lock_init(&(info->data->lock));
+ for (i = 0; i < 256; i++)
+ INIT_LIST_HEAD(&(info->data->iphash[i]));
+
+ return 1;
+}
+
+static void destroy(void *matchinfo, unsigned int matchinfosize)
+{
+ struct ipt_iplimit_info *info = matchinfo;
+ struct ipt_iplimit_conn *conn;
+ struct list_head *hash;
+ int i;
+
+ /* cleanup */
+ for (i = 0; i < 256; i++) {
+ hash = &(info->data->iphash[i]);
+ while (hash != hash->next) {
+ conn = list_entry(hash->next,struct ipt_iplimit_conn,list);
+ list_del(hash->next);
+ kfree(conn);
+ }
+ }
+ kfree(info->data);
+}
+
+static struct ipt_match iplimit_match
+= { { NULL, NULL }, "iplimit", &match, &check, &destroy, THIS_MODULE };
+
+static int __init init(void)
+{
+ /* NULL if ip_conntrack not a module */
+ if (ip_conntrack_module)
+ __MOD_INC_USE_COUNT(ip_conntrack_module);
+ return ipt_register_match(&iplimit_match);
+}
+
+static void __exit fini(void)
+{
+ ipt_unregister_match(&iplimit_match);
+ if (ip_conntrack_module)
+ __MOD_DEC_USE_COUNT(ip_conntrack_module);
+}
+
+module_init(init);
+module_exit(fini);
--
Paul P 'Stingray' Komkoff 'Greatest' Jr // (icq)23200764 // (irc)Spacebar
PPKJ1-RIPE // (smtp)[EMAIL PROTECTED] // (http)stingr.net // (pgp)0xA4B4ECA4
