* libxt_recent: add IPv6 support
2008-09-06 15:47 Jan Engelhardt
@ 2008-09-06 15:48 ` Jan Engelhardt
2008-09-08 13:45 ` Patrick McHardy
0 siblings, 1 reply; 6+ messages in thread
From: Jan Engelhardt @ 2008-09-06 15:48 UTC (permalink / raw)
To: kaber; +Cc: Netfilter Developer Mailing List
commit ed0f93f60c4e654b2ab08d82a2ddf59dea68e03b
Author: Jan Engelhardt <jengelh@medozas.de>
Date: Mon Feb 11 01:13:31 2008 +0100
libxt_recent: add IPv6 support
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
---
extensions/libxt_recent.c | 17 +++++
extensions/libxt_recent.man | 119 +++++++++++++++++------------------
2 files changed, 76 insertions(+), 60 deletions(-)
diff --git a/extensions/libxt_recent.c b/extensions/libxt_recent.c
index 4e770bd..dde9955 100644
--- a/extensions/libxt_recent.c
+++ b/extensions/libxt_recent.c
@@ -236,7 +236,24 @@ static struct xtables_match recent_mt_reg = {
.extra_opts = recent_opts,
};
+static struct xtables_match recent_mt6_reg = {
+ .version = XTABLES_VERSION,
+ .name = "recent",
+ .revision = 0,
+ .family = PF_INET6,
+ .size = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
+ .userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
+ .help = recent_help,
+ .init = recent_init,
+ .parse = recent_parse,
+ .final_check = recent_check,
+ .print = recent_print,
+ .save = recent_save,
+ .extra_opts = recent_opts,
+};
+
void _init(void)
{
xtables_register_match(&recent_mt_reg);
+ xtables_register_match(&recent_mt6_reg);
}
diff --git a/extensions/libxt_recent.man b/extensions/libxt_recent.man
index f752577..6b7fc86 100644
--- a/extensions/libxt_recent.man
+++ b/extensions/libxt_recent.man
@@ -1,19 +1,18 @@
-Allows you to dynamically create a list of IP addresses and then match
-against that list in a few different ways.
-
-For example, you can create a `badguy' list out of people attempting
-to connect to port 139 on your firewall and then DROP all future
-packets from them without considering them.
+Allows you to dynamically create a list of IP addresses and then match against
+that list in a few different ways.
+.PP
+For example, you can create a "badguy" list out of people attempting to connect
+to port 139 on your firewall and then DROP all future packets from them without
+considering them.
.TP
-.BI "--name " "name"
-Specify the list to use for the commands. If no name is given then 'DEFAULT'
-will be used.
+\fB--name\fR \fIname\fR
+Specify the list to use for the commands. If no name is given then
+\fBDEFAULT\fR will be used.
.TP
[\fB!\fR] \fB--set\fR
-This will add the source address of the packet to the list. If the
-source address is already in the list, this will update the existing
-entry. This will always return success (or failure if `!' is passed
-in).
+This will add the source address of the packet to the list. If the source
+address is already in the list, this will update the existing entry. This will
+always return success (or failure if \fB!\fR is passed in).
.TP
\fB--rsource\fP
Match/save the source address of each packet in the recent list table. This
@@ -23,78 +22,78 @@ is the default.
Match/save the destination address of each packet in the recent list table.
.TP
[\fB!\fR] \fB--rcheck\fR
-Check if the source address of the packet is currently in
-the list.
+Check if the source address of the packet is currently in the list.
.TP
[\fB!\fR] \fB--update\fR
Like \fB--rcheck\fR, except it will update the "last seen" timestamp if it
matches.
.TP
[\fB!\fR] \fB--remove\fR
-Check if the source address of the packet is currently in the list and
-if so that address will be removed from the list and the rule will
-return true. If the address is not found, false is returned.
+Check if the source address of the packet is currently in the list and if so
+that address will be removed from the list and the rule will return true. If
+the address is not found, false is returned.
.TP
[\fB!\fR] \fB--seconds \fIseconds\fR
This option must be used in conjunction with one of \fB--rcheck\fR or
-\fB--update\fR. When used, this will narrow the match to only happen
-when the address is in the list and was seen within the last given
-number of seconds.
+\fB--update\fR. When used, this will narrow the match to only happen when the
+address is in the list and was seen within the last given number of seconds.
.TP
[\fB!\fR] \fB--hitcount \fIhits\fR
This option must be used in conjunction with one of \fB--rcheck\fR or
-\fB--update\fR. When used, this will narrow the match to only happen
-when the address is in the list and packets had been received greater
-than or equal to the given value. This option may be used along with
-\fB--seconds\fR to create an even narrower match requiring a certain
-number of hits within a specific time frame.
+\fB--update\fR. When used, this will narrow the match to only happen when the
+address is in the list and packets had been received greater than or equal to
+the given value. This option may be used along with \fB--seconds\fR to create
+an even narrower match requiring a certain number of hits within a specific
+time frame.
.TP
\fB--rttl\fR
This option must be used in conjunction with one of \fB--rcheck\fR or
-\fB--update\fR. When used, this will narrow the match to only happen
-when the address is in the list and the TTL of the current packet
-matches that of the packet which hit the \fB--set\fR rule. This may be
-useful if you have problems with people faking their source address in
-order to DoS you via this module by disallowing others access to your
-site by sending bogus packets to you.
-.P
+\fB--update\fR. When used, this will narrow the match to only happen when the
+address is in the list and the TTL of the current packet matches that of the
+packet which hit the \fB--set\fR rule. This may be useful if you have problems
+with people faking their source address in order to DoS you via this module by
+disallowing others access to your site by sending bogus packets to you.
+.PP
Examples:
.IP
-# iptables -A FORWARD -m recent --name badguy --rcheck --seconds 60 -j DROP
-
-# iptables -A FORWARD -p tcp -i eth0 --dport 139 -m recent --name badguy --set -j DROP
-.P
-Official website (http://snowman.net/projects/ipt_recent/) also has
+iptables -A FORWARD -m recent --name badguy --rcheck --seconds 60 -j DROP
+.IP
+iptables -A FORWARD -p tcp -i eth0 --dport 139 -m recent --name badguy --set -j DROP
+.PP
+Steve's ipt_recent website (http://snowman.net/projects/ipt_recent/) also has
some examples of usage.
-
-/proc/net/ipt_recent/* are the current lists of addresses and information
+.PP
+\fB/proc/net/xt_recent/*\fR are the current lists of addresses and information
about each entry of each list.
-
-Each file in /proc/net/ipt_recent/ can be read from to see the current list
-or written two using the following commands to modify the list:
+.PP
+Each file in \fB/proc/net/xt_recent/\fR can be read from to see the current
+list or written two using the following commands to modify the list:
.TP
-echo xx.xx.xx.xx > /proc/net/ipt_recent/DEFAULT
-to Add to the DEFAULT list
+\fBecho +\fR\fIaddr\fR\fB >/proc/net/xt_recent/DEFAULT\fR
+to add \fIaddr\fR to the DEFAULT list
.TP
-echo -xx.xx.xx.xx > /proc/net/ipt_recent/DEFAULT
-to Remove from the DEFAULT list
+\fBecho -\fR\fIaddr\fR\fB >/proc/net/xt_recent/DEFAULT\fR
+to remove \fIaddr\fR from the DEFAULT list
.TP
-echo clear > /proc/net/ipt_recent/DEFAULT
-to empty the DEFAULT list.
-.P
+\fBecho / >/proc/net/xt_recent/DEFAULT\fR
+to flush the DEFAULT list (remove all entries).
+.PP
The module itself accepts parameters, defaults shown:
.TP
-.BI "ip_list_tot=" "100"
-Number of addresses remembered per table
+\fBip_list_tot\fR=\fI100\fR
+Number of addresses remembered per table.
+.TP
+\fBip_pkt_list_tot\fR=\fI20\fR
+Number of packets per address remembered.
.TP
-.BI "ip_pkt_list_tot=" "20"
-Number of packets per address remembered
+\fBip_list_hash_size\fR=\fI0\fR
+Hash table size. 0 means to calculate it based on ip_list_tot, default: 512.
.TP
-.BI "ip_list_hash_size=" "0"
-Hash table size. 0 means to calculate it based on ip_list_tot, default: 512
+\fBip_list_perms\fR=\fI0644\fR
+Permissions for /proc/net/xt_recent/* files.
.TP
-.BI "ip_list_perms=" "0644"
-Permissions for /proc/net/ipt_recent/* files
+\fBip_list_uid\fR=\fI0\fR
+Numerical UID for ownership of /proc/net/xt_recent/* files.
.TP
-.BI "debug=" "0"
-Set to 1 to get lots of debugging info
+\fBip_list_gid\fR=\fI0\fR
+Numerical GID for ownership of /proc/net/xt_recent/* files.
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: libxt_recent: add IPv6 support
2008-09-06 15:48 ` libxt_recent: add IPv6 support Jan Engelhardt
@ 2008-09-08 13:45 ` Patrick McHardy
0 siblings, 0 replies; 6+ messages in thread
From: Patrick McHardy @ 2008-09-08 13:45 UTC (permalink / raw)
To: Jan Engelhardt; +Cc: Netfilter Developer Mailing List
Jan Engelhardt wrote:
> commit ed0f93f60c4e654b2ab08d82a2ddf59dea68e03b
> Author: Jan Engelhardt <jengelh@medozas.de>
> Date: Mon Feb 11 01:13:31 2008 +0100
>
> libxt_recent: add IPv6 support
These need to wait until we've released the 1.4.2 version.
Please resend at that time.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Move libipt_recent to libxt_recent
@ 2008-10-22 16:45 Jan Engelhardt
2008-10-22 16:45 ` libxt_recent: add IPv6 support Jan Engelhardt
2008-10-22 16:50 ` Move libipt_recent to libxt_recent Patrick McHardy
0 siblings, 2 replies; 6+ messages in thread
From: Jan Engelhardt @ 2008-10-22 16:45 UTC (permalink / raw)
To: kaber; +Cc: Netfilter Developer Mailing List
commit d4cc5a5eb6c20f4771f6e348849a3cfef3e283c7
Author: Jan Engelhardt <jengelh@medozas.de>
Date: Wed Oct 22 12:20:32 2008 -0400
Move libipt_recent to libxt_recent
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
---
extensions/{libipt_recent.c => libxt_recent.c} | 127 ++++++------
extensions/{libipt_recent.man => libxt_recent.man} | 2 +-
include/linux/netfilter/xt_recent.h | 26 +++
include/linux/netfilter_ipv4/ipt_recent.h | 27 ---
4 files changed, 91 insertions(+), 91 deletions(-)
rename extensions/{libipt_recent.c => libxt_recent.c} (65%)
rename extensions/{libipt_recent.man => libxt_recent.man} (99%)
create mode 100644 include/linux/netfilter/xt_recent.h
delete mode 100644 include/linux/netfilter_ipv4/ipt_recent.h
diff --git a/extensions/libipt_recent.c b/extensions/libxt_recent.c
similarity index 65%
rename from extensions/libipt_recent.c
rename to extensions/libxt_recent.c
index 7281fe5..028c563 100644
--- a/extensions/libipt_recent.c
+++ b/extensions/libxt_recent.c
@@ -5,27 +5,14 @@
#include <stdlib.h>
#include <getopt.h>
-#include <iptables.h>
-#include <linux/netfilter_ipv4/ipt_recent.h>
-
-/* Need these in order to not fail when compiling against an older kernel. */
-#ifndef RECENT_NAME
-#define RECENT_NAME "ipt_recent"
-#endif /* RECENT_NAME */
-
-#ifndef RECENT_VER
-#define RECENT_VER "unknown"
-#endif /* RECENT_VER */
-
-#ifndef IPT_RECENT_NAME_LEN
-#define IPT_RECENT_NAME_LEN 200
-#endif /* IPT_RECENT_NAME_LEN */
+#include <xtables.h>
+#include <linux/netfilter/xt_recent.h>
static const struct option recent_opts[] = {
- { .name = "set", .has_arg = 0, .val = 201 },
- { .name = "rcheck", .has_arg = 0, .val = 202 },
+ { .name = "set", .has_arg = 0, .val = 201 },
+ { .name = "rcheck", .has_arg = 0, .val = 202 },
{ .name = "update", .has_arg = 0, .val = 203 },
- { .name = "seconds", .has_arg = 1, .val = 204 },
+ { .name = "seconds", .has_arg = 1, .val = 204 },
{ .name = "hitcount", .has_arg = 1, .val = 205 },
{ .name = "remove", .has_arg = 0, .val = 206 },
{ .name = "rttl", .has_arg = 0, .val = 207 },
@@ -57,29 +44,29 @@ static void recent_help(void)
" --name name Name of the recent list to be used. DEFAULT used if none given.\n"
" --rsource Match/Save the source address of each packet in the recent list table (default).\n"
" --rdest Match/Save the destination address of each packet in the recent list table.\n"
-RECENT_NAME " " RECENT_VER ": Stephen Frost <sfrost@snowman.net>. http://snowman.net/projects/ipt_recent/\n");
+"xt_recent by: Stephen Frost <sfrost@snowman.net>. http://snowman.net/projects/ipt_recent/\n");
}
static void recent_init(struct xt_entry_match *match)
{
- struct ipt_recent_info *info = (struct ipt_recent_info *)(match)->data;
+ struct xt_recent_mtinfo *info = (void *)(match)->data;
-
- strncpy(info->name,"DEFAULT",IPT_RECENT_NAME_LEN);
- /* eventhough IPT_RECENT_NAME_LEN is currently defined as 200,
+ strncpy(info->name,"DEFAULT", XT_RECENT_NAME_LEN);
+ /* even though XT_RECENT_NAME_LEN is currently defined as 200,
* better be safe, than sorry */
- info->name[IPT_RECENT_NAME_LEN-1] = '\0';
- info->side = IPT_RECENT_SOURCE;
+ info->name[XT_RECENT_NAME_LEN-1] = '\0';
+ info->side = XT_RECENT_SOURCE;
}
#define RECENT_CMDS \
- (IPT_RECENT_SET | IPT_RECENT_CHECK | \
- IPT_RECENT_UPDATE | IPT_RECENT_REMOVE)
+ (XT_RECENT_SET | XT_RECENT_CHECK | \
+ XT_RECENT_UPDATE | XT_RECENT_REMOVE)
static int recent_parse(int c, char **argv, int invert, unsigned int *flags,
const void *entry, struct xt_entry_match **match)
{
- struct ipt_recent_info *info = (struct ipt_recent_info *)(*match)->data;
+ struct xt_recent_mtinfo *info = (void *)(*match)->data;
+
switch (c) {
case 201:
if (*flags & RECENT_CMDS)
@@ -87,20 +74,20 @@ static int recent_parse(int c, char **argv, int invert, unsigned int *flags,
"recent: only one of `--set', `--rcheck' "
"`--update' or `--remove' may be set");
check_inverse(optarg, &invert, &optind, 0);
- info->check_set |= IPT_RECENT_SET;
+ info->check_set |= XT_RECENT_SET;
if (invert) info->invert = 1;
- *flags |= IPT_RECENT_SET;
+ *flags |= XT_RECENT_SET;
break;
-
+
case 202:
if (*flags & RECENT_CMDS)
exit_error(PARAMETER_PROBLEM,
"recent: only one of `--set', `--rcheck' "
"`--update' or `--remove' may be set");
check_inverse(optarg, &invert, &optind, 0);
- info->check_set |= IPT_RECENT_CHECK;
+ info->check_set |= XT_RECENT_CHECK;
if(invert) info->invert = 1;
- *flags |= IPT_RECENT_CHECK;
+ *flags |= XT_RECENT_CHECK;
break;
case 203:
@@ -109,9 +96,9 @@ static int recent_parse(int c, char **argv, int invert, unsigned int *flags,
"recent: only one of `--set', `--rcheck' "
"`--update' or `--remove' may be set");
check_inverse(optarg, &invert, &optind, 0);
- info->check_set |= IPT_RECENT_UPDATE;
+ info->check_set |= XT_RECENT_UPDATE;
if (invert) info->invert = 1;
- *flags |= IPT_RECENT_UPDATE;
+ *flags |= XT_RECENT_UPDATE;
break;
case 206:
@@ -120,9 +107,9 @@ static int recent_parse(int c, char **argv, int invert, unsigned int *flags,
"recent: only one of `--set', `--rcheck' "
"`--update' or `--remove' may be set");
check_inverse(optarg, &invert, &optind, 0);
- info->check_set |= IPT_RECENT_REMOVE;
+ info->check_set |= XT_RECENT_REMOVE;
if (invert) info->invert = 1;
- *flags |= IPT_RECENT_REMOVE;
+ *flags |= XT_RECENT_REMOVE;
break;
case 204:
@@ -134,21 +121,21 @@ static int recent_parse(int c, char **argv, int invert, unsigned int *flags,
break;
case 207:
- info->check_set |= IPT_RECENT_TTL;
- *flags |= IPT_RECENT_TTL;
+ info->check_set |= XT_RECENT_TTL;
+ *flags |= XT_RECENT_TTL;
break;
case 208:
- strncpy(info->name,optarg,IPT_RECENT_NAME_LEN);
- info->name[IPT_RECENT_NAME_LEN-1] = '\0';
+ strncpy(info->name,optarg, XT_RECENT_NAME_LEN);
+ info->name[XT_RECENT_NAME_LEN-1] = '\0';
break;
case 209:
- info->side = IPT_RECENT_SOURCE;
+ info->side = XT_RECENT_SOURCE;
break;
case 210:
- info->side = IPT_RECENT_DEST;
+ info->side = XT_RECENT_DEST;
break;
default:
@@ -164,8 +151,8 @@ static void recent_check(unsigned int flags)
exit_error(PARAMETER_PROBLEM,
"recent: you must specify one of `--set', `--rcheck' "
"`--update' or `--remove'");
- if ((flags & IPT_RECENT_TTL) &&
- (flags & (IPT_RECENT_SET | IPT_RECENT_REMOVE)))
+ if ((flags & XT_RECENT_TTL) &&
+ (flags & (XT_RECENT_SET | XT_RECENT_REMOVE)))
exit_error(PARAMETER_PROBLEM,
"recent: --rttl may only be used with --rcheck or "
"--update");
@@ -174,49 +161,63 @@ static void recent_check(unsigned int flags)
static void recent_print(const void *ip, const struct xt_entry_match *match,
int numeric)
{
- struct ipt_recent_info *info = (struct ipt_recent_info *)match->data;
+ const struct xt_recent_mtinfo *info = (const void *)match->data;
if (info->invert)
fputc('!', stdout);
printf("recent: ");
- if(info->check_set & IPT_RECENT_SET) printf("SET ");
- if(info->check_set & IPT_RECENT_CHECK) printf("CHECK ");
- if(info->check_set & IPT_RECENT_UPDATE) printf("UPDATE ");
- if(info->check_set & IPT_RECENT_REMOVE) printf("REMOVE ");
+ if (info->check_set & XT_RECENT_SET)
+ printf("SET ");
+ if (info->check_set & XT_RECENT_CHECK)
+ printf("CHECK ");
+ if (info->check_set & XT_RECENT_UPDATE)
+ printf("UPDATE ");
+ if (info->check_set & XT_RECENT_REMOVE)
+ printf("REMOVE ");
if(info->seconds) printf("seconds: %d ",info->seconds);
if(info->hit_count) printf("hit_count: %d ",info->hit_count);
- if(info->check_set & IPT_RECENT_TTL) printf("TTL-Match ");
+ if (info->check_set & XT_RECENT_TTL)
+ printf("TTL-Match ");
if(info->name) printf("name: %s ",info->name);
- if(info->side == IPT_RECENT_SOURCE) printf("side: source ");
- if(info->side == IPT_RECENT_DEST) printf("side: dest");
+ if (info->side == XT_RECENT_SOURCE)
+ printf("side: source ");
+ if (info->side == XT_RECENT_DEST)
+ printf("side: dest");
}
static void recent_save(const void *ip, const struct xt_entry_match *match)
{
- struct ipt_recent_info *info = (struct ipt_recent_info *)match->data;
+ const struct xt_recent_mtinfo *info = (const void *)match->data;
if (info->invert)
printf("! ");
- if(info->check_set & IPT_RECENT_SET) printf("--set ");
- if(info->check_set & IPT_RECENT_CHECK) printf("--rcheck ");
- if(info->check_set & IPT_RECENT_UPDATE) printf("--update ");
- if(info->check_set & IPT_RECENT_REMOVE) printf("--remove ");
+ if (info->check_set & XT_RECENT_SET)
+ printf("--set ");
+ if (info->check_set & XT_RECENT_CHECK)
+ printf("--rcheck ");
+ if (info->check_set & XT_RECENT_UPDATE)
+ printf("--update ");
+ if (info->check_set & XT_RECENT_REMOVE)
+ printf("--remove ");
if(info->seconds) printf("--seconds %d ",info->seconds);
if(info->hit_count) printf("--hitcount %d ",info->hit_count);
- if(info->check_set & IPT_RECENT_TTL) printf("--rttl ");
+ if (info->check_set & XT_RECENT_TTL)
+ printf("--rttl ");
if(info->name) printf("--name %s ",info->name);
- if(info->side == IPT_RECENT_SOURCE) printf("--rsource ");
- if(info->side == IPT_RECENT_DEST) printf("--rdest ");
+ if (info->side == XT_RECENT_SOURCE)
+ printf("--rsource ");
+ if (info->side == XT_RECENT_DEST)
+ printf("--rdest ");
}
static struct xtables_match recent_mt_reg = {
.name = "recent",
.version = XTABLES_VERSION,
.family = PF_INET,
- .size = XT_ALIGN(sizeof(struct ipt_recent_info)),
- .userspacesize = XT_ALIGN(sizeof(struct ipt_recent_info)),
+ .size = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
+ .userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
.help = recent_help,
.init = recent_init,
.parse = recent_parse,
diff --git a/extensions/libipt_recent.man b/extensions/libxt_recent.man
similarity index 99%
rename from extensions/libipt_recent.man
rename to extensions/libxt_recent.man
index d5bdaa0..f36457c 100644
--- a/extensions/libipt_recent.man
+++ b/extensions/libxt_recent.man
@@ -67,7 +67,7 @@ Examples:
Official website (http://snowman.net/projects/ipt_recent/) also has
some examples of usage.
-/proc/net/ipt_recent/* are the current lists of addresses and information
+/proc/net/ipt_recent/* are the current lists of addresses and information
about each entry of each list.
Each file in /proc/net/ipt_recent/ can be read from to see the current list
diff --git a/include/linux/netfilter/xt_recent.h b/include/linux/netfilter/xt_recent.h
new file mode 100644
index 0000000..5cfeb81
--- /dev/null
+++ b/include/linux/netfilter/xt_recent.h
@@ -0,0 +1,26 @@
+#ifndef _LINUX_NETFILTER_XT_RECENT_H
+#define _LINUX_NETFILTER_XT_RECENT_H 1
+
+enum {
+ XT_RECENT_CHECK = 1 << 0,
+ XT_RECENT_SET = 1 << 1,
+ XT_RECENT_UPDATE = 1 << 2,
+ XT_RECENT_REMOVE = 1 << 3,
+ XT_RECENT_TTL = 1 << 4,
+
+ XT_RECENT_SOURCE = 0,
+ XT_RECENT_DEST = 1,
+
+ XT_RECENT_NAME_LEN = 200,
+};
+
+struct xt_recent_mtinfo {
+ u_int32_t seconds;
+ u_int32_t hit_count;
+ u_int8_t check_set;
+ u_int8_t invert;
+ char name[XT_RECENT_NAME_LEN];
+ u_int8_t side;
+};
+
+#endif /* _LINUX_NETFILTER_XT_RECENT_H */
diff --git a/include/linux/netfilter_ipv4/ipt_recent.h b/include/linux/netfilter_ipv4/ipt_recent.h
deleted file mode 100644
index 6508a45..0000000
--- a/include/linux/netfilter_ipv4/ipt_recent.h
+++ /dev/null
@@ -1,27 +0,0 @@
-#ifndef _IPT_RECENT_H
-#define _IPT_RECENT_H
-
-#define RECENT_NAME "ipt_recent"
-#define RECENT_VER "v0.3.1"
-
-#define IPT_RECENT_CHECK 1
-#define IPT_RECENT_SET 2
-#define IPT_RECENT_UPDATE 4
-#define IPT_RECENT_REMOVE 8
-#define IPT_RECENT_TTL 16
-
-#define IPT_RECENT_SOURCE 0
-#define IPT_RECENT_DEST 1
-
-#define IPT_RECENT_NAME_LEN 200
-
-struct ipt_recent_info {
- u_int32_t seconds;
- u_int32_t hit_count;
- u_int8_t check_set;
- u_int8_t invert;
- char name[IPT_RECENT_NAME_LEN];
- u_int8_t side;
-};
-
-#endif /*_IPT_RECENT_H*/
^ permalink raw reply related [flat|nested] 6+ messages in thread
* libxt_recent: add IPv6 support
2008-10-22 16:45 Move libipt_recent to libxt_recent Jan Engelhardt
@ 2008-10-22 16:45 ` Jan Engelhardt
2008-10-22 16:54 ` Patrick McHardy
2008-10-22 16:50 ` Move libipt_recent to libxt_recent Patrick McHardy
1 sibling, 1 reply; 6+ messages in thread
From: Jan Engelhardt @ 2008-10-22 16:45 UTC (permalink / raw)
To: kaber; +Cc: Netfilter Developer Mailing List
commit 45dab2419867734051c34ff3f7c11b66c911ed31
Author: Jan Engelhardt <jengelh@medozas.de>
Date: Wed Oct 22 12:40:46 2008 -0400
libxt_recent: add IPv6 support
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
---
extensions/libxt_recent.c | 17 +++++
extensions/libxt_recent.man | 119 +++++++++++++++++------------------
2 files changed, 76 insertions(+), 60 deletions(-)
diff --git a/extensions/libxt_recent.c b/extensions/libxt_recent.c
index 028c563..59a3ca8 100644
--- a/extensions/libxt_recent.c
+++ b/extensions/libxt_recent.c
@@ -227,7 +227,24 @@ static struct xtables_match recent_mt_reg = {
.extra_opts = recent_opts,
};
+static struct xtables_match recent_mt6_reg = {
+ .version = XTABLES_VERSION,
+ .name = "recent",
+ .revision = 0,
+ .family = PF_INET6,
+ .size = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
+ .userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
+ .help = recent_help,
+ .init = recent_init,
+ .parse = recent_parse,
+ .final_check = recent_check,
+ .print = recent_print,
+ .save = recent_save,
+ .extra_opts = recent_opts,
+};
+
void _init(void)
{
xtables_register_match(&recent_mt_reg);
+ xtables_register_match(&recent_mt6_reg);
}
diff --git a/extensions/libxt_recent.man b/extensions/libxt_recent.man
index f36457c..e30bb56 100644
--- a/extensions/libxt_recent.man
+++ b/extensions/libxt_recent.man
@@ -1,19 +1,18 @@
-Allows you to dynamically create a list of IP addresses and then match
-against that list in a few different ways.
-
-For example, you can create a `badguy' list out of people attempting
-to connect to port 139 on your firewall and then DROP all future
-packets from them without considering them.
+Allows you to dynamically create a list of IP addresses and then match against
+that list in a few different ways.
+.PP
+For example, you can create a "badguy" list out of people attempting to connect
+to port 139 on your firewall and then DROP all future packets from them without
+considering them.
.TP
-.BI "--name " "name"
-Specify the list to use for the commands. If no name is given then 'DEFAULT'
-will be used.
+\fB--name\fR \fIname\fR
+Specify the list to use for the commands. If no name is given then
+\fBDEFAULT\fR will be used.
.TP
[\fB!\fR] \fB--set\fR
-This will add the source address of the packet to the list. If the
-source address is already in the list, this will update the existing
-entry. This will always return success (or failure if `!' is passed
-in).
+This will add the source address of the packet to the list. If the source
+address is already in the list, this will update the existing entry. This will
+always return success (or failure if \fB!\fR is passed in).
.TP
\fB--rsource\fP
Match/save the source address of each packet in the recent list table. This
@@ -23,78 +22,78 @@ is the default.
Match/save the destination address of each packet in the recent list table.
.TP
[\fB!\fR] \fB--rcheck\fR
-Check if the source address of the packet is currently in
-the list.
+Check if the source address of the packet is currently in the list.
.TP
[\fB!\fR] \fB--update\fR
Like \fB--rcheck\fR, except it will update the "last seen" timestamp if it
matches.
.TP
[\fB!\fR] \fB--remove\fR
-Check if the source address of the packet is currently in the list and
-if so that address will be removed from the list and the rule will
-return true. If the address is not found, false is returned.
+Check if the source address of the packet is currently in the list and if so
+that address will be removed from the list and the rule will return true. If
+the address is not found, false is returned.
.TP
[\fB!\fR] \fB--seconds \fIseconds\fR
This option must be used in conjunction with one of \fB--rcheck\fR or
-\fB--update\fR. When used, this will narrow the match to only happen
-when the address is in the list and was seen within the last given
-number of seconds.
+\fB--update\fR. When used, this will narrow the match to only happen when the
+address is in the list and was seen within the last given number of seconds.
.TP
[\fB!\fR] \fB--hitcount \fIhits\fR
This option must be used in conjunction with one of \fB--rcheck\fR or
-\fB--update\fR. When used, this will narrow the match to only happen
-when the address is in the list and packets had been received greater
-than or equal to the given value. This option may be used along with
-\fB--seconds\fR to create an even narrower match requiring a certain
-number of hits within a specific time frame.
+\fB--update\fR. When used, this will narrow the match to only happen when the
+address is in the list and packets had been received greater than or equal to
+the given value. This option may be used along with \fB--seconds\fR to create
+an even narrower match requiring a certain number of hits within a specific
+time frame.
.TP
\fB--rttl\fR
This option may only be used in conjunction with one of \fB--rcheck\fR or
-\fB--update\fR. When used, this will narrow the match to only happen
-when the address is in the list and the TTL of the current packet
-matches that of the packet which hit the \fB--set\fR rule. This may be
-useful if you have problems with people faking their source address in
-order to DoS you via this module by disallowing others access to your
-site by sending bogus packets to you.
-.P
+\fB--update\fR. When used, this will narrow the match to only happen when the
+address is in the list and the TTL of the current packet matches that of the
+packet which hit the \fB--set\fR rule. This may be useful if you have problems
+with people faking their source address in order to DoS you via this module by
+disallowing others access to your site by sending bogus packets to you.
+.PP
Examples:
.IP
-# iptables -A FORWARD -m recent --name badguy --rcheck --seconds 60 -j DROP
-
-# iptables -A FORWARD -p tcp -i eth0 --dport 139 -m recent --name badguy --set -j DROP
-.P
-Official website (http://snowman.net/projects/ipt_recent/) also has
+iptables -A FORWARD -m recent --name badguy --rcheck --seconds 60 -j DROP
+.IP
+iptables -A FORWARD -p tcp -i eth0 --dport 139 -m recent --name badguy --set -j DROP
+.PP
+Steve's ipt_recent website (http://snowman.net/projects/ipt_recent/) also has
some examples of usage.
-
-/proc/net/ipt_recent/* are the current lists of addresses and information
+.PP
+\fB/proc/net/xt_recent/*\fR are the current lists of addresses and information
about each entry of each list.
-
-Each file in /proc/net/ipt_recent/ can be read from to see the current list
-or written two using the following commands to modify the list:
+.PP
+Each file in \fB/proc/net/xt_recent/\fR can be read from to see the current
+list or written two using the following commands to modify the list:
.TP
-echo xx.xx.xx.xx > /proc/net/ipt_recent/DEFAULT
-to Add to the DEFAULT list
+\fBecho +\fR\fIaddr\fR\fB >/proc/net/xt_recent/DEFAULT\fR
+to add \fIaddr\fR to the DEFAULT list
.TP
-echo -xx.xx.xx.xx > /proc/net/ipt_recent/DEFAULT
-to Remove from the DEFAULT list
+\fBecho -\fR\fIaddr\fR\fB >/proc/net/xt_recent/DEFAULT\fR
+to remove \fIaddr\fR from the DEFAULT list
.TP
-echo clear > /proc/net/ipt_recent/DEFAULT
-to empty the DEFAULT list.
-.P
+\fBecho / >/proc/net/xt_recent/DEFAULT\fR
+to flush the DEFAULT list (remove all entries).
+.PP
The module itself accepts parameters, defaults shown:
.TP
-.BI "ip_list_tot=" "100"
-Number of addresses remembered per table
+\fBip_list_tot\fR=\fI100\fR
+Number of addresses remembered per table.
+.TP
+\fBip_pkt_list_tot\fR=\fI20\fR
+Number of packets per address remembered.
.TP
-.BI "ip_pkt_list_tot=" "20"
-Number of packets per address remembered
+\fBip_list_hash_size\fR=\fI0\fR
+Hash table size. 0 means to calculate it based on ip_list_tot, default: 512.
.TP
-.BI "ip_list_hash_size=" "0"
-Hash table size. 0 means to calculate it based on ip_list_tot, default: 512
+\fBip_list_perms\fR=\fI0644\fR
+Permissions for /proc/net/xt_recent/* files.
.TP
-.BI "ip_list_perms=" "0644"
-Permissions for /proc/net/ipt_recent/* files
+\fBip_list_uid\fR=\fI0\fR
+Numerical UID for ownership of /proc/net/xt_recent/* files.
.TP
-.BI "debug=" "0"
-Set to 1 to get lots of debugging info
+\fBip_list_gid\fR=\fI0\fR
+Numerical GID for ownership of /proc/net/xt_recent/* files.
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: Move libipt_recent to libxt_recent
2008-10-22 16:45 Move libipt_recent to libxt_recent Jan Engelhardt
2008-10-22 16:45 ` libxt_recent: add IPv6 support Jan Engelhardt
@ 2008-10-22 16:50 ` Patrick McHardy
1 sibling, 0 replies; 6+ messages in thread
From: Patrick McHardy @ 2008-10-22 16:50 UTC (permalink / raw)
To: Jan Engelhardt; +Cc: Netfilter Developer Mailing List
Jan Engelhardt wrote:
> commit d4cc5a5eb6c20f4771f6e348849a3cfef3e283c7
> Author: Jan Engelhardt <jengelh@medozas.de>
> Date: Wed Oct 22 12:20:32 2008 -0400
>
> Move libipt_recent to libxt_recent
Applied, thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: libxt_recent: add IPv6 support
2008-10-22 16:45 ` libxt_recent: add IPv6 support Jan Engelhardt
@ 2008-10-22 16:54 ` Patrick McHardy
0 siblings, 0 replies; 6+ messages in thread
From: Patrick McHardy @ 2008-10-22 16:54 UTC (permalink / raw)
To: Jan Engelhardt; +Cc: Netfilter Developer Mailing List
Jan Engelhardt wrote:
> commit 45dab2419867734051c34ff3f7c11b66c911ed31
> Author: Jan Engelhardt <jengelh@medozas.de>
> Date: Wed Oct 22 12:40:46 2008 -0400
>
> libxt_recent: add IPv6 support
Also applied, thanks Jan.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2008-10-22 16:54 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-10-22 16:45 Move libipt_recent to libxt_recent Jan Engelhardt
2008-10-22 16:45 ` libxt_recent: add IPv6 support Jan Engelhardt
2008-10-22 16:54 ` Patrick McHardy
2008-10-22 16:50 ` Move libipt_recent to libxt_recent Patrick McHardy
-- strict thread matches above, loose matches on Subject: below --
2008-09-06 15:47 Jan Engelhardt
2008-09-06 15:48 ` libxt_recent: add IPv6 support Jan Engelhardt
2008-09-08 13:45 ` Patrick McHardy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox