Looking for Log Analyzer

Looking for Log Analyzer

[Susan Sagan]

[-- Attachment #1: Type: text/plain, Size: 462 bytes --]

Before writing my own, I was wondering if there were tools available for
analyzing the output log file from iptables.  I was in particular looking
for tools which created a variety of different reports.  One such example
being a report listing the top traffic generators. 


Susan Sagan
Unix Systems Administrator
Ottawa Data Center, Unix Services
CGI Information Systems and Management
Phone: 613-740-5900 ext 5351
Fax: 613-749-2201
Email: susan.sagan@cgi.com


[-- Attachment #2: winmail.dat --]
[-- Type: application/ms-tnef, Size: 1716 bytes --]

Re: Looking for Log Analyzer

[Hervé Eychenne]

On Thu, Jan 30, 2003 at 03:48:47PM -0500, Susan Sagan wrote:

> Before writing my own, I was wondering if there were tools available for
> analyzing the output log file from iptables.  I was in particular looking
> for tools which created a variety of different reports.  One such example
> being a report listing the top traffic generators. 

Try wflogs...
http://www.wallfire.org/wflogs/

 RV

-- 
 _
(°=  Hervé Eychenne
//)
v_/_ WallFire project:  http://www.wallfire.org/

IPLIMIT Patch UDP

[Ing. CIP Alejandro Celi Mariategui]

(Sorry, but my english is very bad)

Hi,

I compile with p-o-m the server kernel with IPLIMIT Patch by Gerd Knorr
<kraxel@bytesex.org>

It work fine, i can limit ex: max 10 TCP connections on the server, but
i want to limit the UDP connections to 10 (max).

How I can do it?

Alex

Re: IPLIMIT Patch UDP

[Jan Du Caju]

Hi,

Ing. CIP Alejandro Celi Mariategui wrote:

>(Sorry, but my english is very bad)
>
>Hi,
>
>I compile with p-o-m the server kernel with IPLIMIT Patch by Gerd Knorr
><kraxel@bytesex.org>
>
>It work fine, i can limit ex: max 10 TCP connections on the server, but
>i want to limit the UDP connections to 10 (max).
>
>How I can do it?
>
This week I made a updlimit patch (shameless copy of iplimit ;-)
I will post it this afternoon/evening when I have more time (and
a cross post to the netfilter-devel list. Maybe they like it)

Greetz,
Jan.
------------------------------------- KULeuvenNet ------

Re: IPLIMIT Patch UDP

[Joel Newkirk]

On Thursday 20 February 2003 06:50 pm, "Ing. CIP Alejandro Celi " 
Mariategui wrote:
> (Sorry, but my english is very bad)
>
> Hi,
>
> I compile with p-o-m the server kernel with IPLIMIT Patch by Gerd
> Knorr <kraxel@bytesex.org>
>
> It work fine, i can limit ex: max 10 TCP connections on the server,
> but i want to limit the UDP connections to 10 (max).
>
> How I can do it?
>
> Alex

The IPLIMIT patch is limited to only work with TCP.  You'd likely need to 
write your own changes to the kernel.  At a VERY quick glance, this:

+	/* refuse anything but tcp */
+	if (ip->proto != IPPROTO_TCP)
+		return 0;

in the IPLIMIT patch (in iplimit.c) MIGHT provide the solution if it 
accomodated IPPROTO_UPD as well as, or instead of, IPPROTO_TCP.

j

RE: IPLIMIT Patch UDP

[Jan Du Caju]

[-- Attachment #1: Type: text/plain, Size: 1331 bytes --]

Hi again,

Jan Du Caju wrote:
 > >  Ing. CIP Alejandro Celi Mariategui wrote:
 > >
 > >  (Sorry, but my english is very bad)
 > >  Hi,
 > >  I compile with p-o-m the server kernel with IPLIMIT Patch by Gerd
 > >  Knorr
 > >  [1]<kraxel@bytesex.org>
 > >  It work fine, i can limit ex: max 10 TCP connections on the server,
 > >  but i want to limit the UDP connections to 10 (max).
 > >  How I can do it?

 >    This week I made a updlimit patch (shameless copy of iplimit ;-)
 >    I will post it this afternoon/evening when I have more time (and
 >    a cross post to the netfilter-devel list. Maybe they like it)

In attachment you will find:
 udplimit.patch
 udplimit.patch.config.in
 udplimit.patch.configure.help
 udplimit.patch.help
 udplimit.patch.makefile

put those under <patch-o-matic>/base/ directory

in the <patch-o-matic> directory you run: ./runme base
(don't forget to select udplimit ;-)

recompile your kernel (with Connections/UDP limit match support
CONFIG_IP_NF_MATCH_UDPLIMIT ;-)

Place the other file attachment (libipt_udplimit.c) in the directory
<iptables>/extensions/

in this directory you will also find the file Makefile where you add
udplimit just after iplimit

recompile iptables

Hope this helps (it works for me :-)

Greetz,
Jan.
--------------------------------------------- KULeuvenNet -----

[-- Attachment #2: udplimit.patch --]
[-- Type: text/plain, Size: 6133 bytes --]

diff -urN -x *~ -x [Cc]onfig.* -x Makefile vanilla-2.4.21-pre4/net/ipv4/netfilter/ipt_udplimit.c linux-2.4.21-pre4/net/ipv4/netfilter/ipt_udplimit.c
--- vanilla-2.4.21-pre4/net/ipv4/netfilter/ipt_udplimit.c	Fri Feb 21 17:20:55 2003
+++ linux-2.4.21-pre4/net/ipv4/netfilter/ipt_udplimit.c	Fri Feb 21 17:17:38 2003
@@ -0,0 +1,215 @@
+/*
+ * netfilter module to limit the number of parallel udp
+ * connections per IP address.
+ * Jan Du Caju <Jan.DuCaju@kuleuven.net>
+ *
+ * based on ...
+ * iplimit (in fact a shameless copy ;-)
+ *   (c) 2000 Gerd Knorr <kraxel@bytesex.org>
+ *   Nov 2002: Martin Bene <martin.bene@icomedias.com>:
+ *		only ignore TIME_WAIT or gone connections
+ *
+ *
+ * Kernel module to match connection tracking information.
+ * GPL (C) 1999  Rusty Russell (rusty@rustcorp.com.au).
+ */
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/list.h>
+#include <linux/netfilter_ipv4/ip_conntrack.h>
+#include <linux/netfilter_ipv4/ip_conntrack_core.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_iplimit.h>
+
+#define DEBUG 0
+
+MODULE_LICENSE("GPL");
+
+/* we'll save the tuples of all connections we care about */
+struct ipt_iplimit_conn
+{
+        struct list_head list;
+	struct ip_conntrack_tuple tuple;
+};
+
+struct ipt_iplimit_data {
+	spinlock_t lock;
+	struct list_head iphash[256];
+};
+
+static int ipt_iphash(u_int32_t addr)
+{
+	int hash;
+
+	hash  =  addr        & 0xff;
+	hash ^= (addr >>  8) & 0xff;
+	hash ^= (addr >> 16) & 0xff;
+	hash ^= (addr >> 24) & 0xff;
+	return hash;
+}
+
+static int count_them(struct ipt_iplimit_data *data,
+		      u_int32_t addr, u_int32_t mask,
+		      struct ip_conntrack *ct)
+{
+	int addit = 1, matches = 0;
+	struct ip_conntrack_tuple tuple;
+	struct ip_conntrack_tuple_hash *found;
+	struct ipt_iplimit_conn *conn;
+	struct list_head *hash,*lh;
+
+	spin_lock(&data->lock);
+	tuple = ct->tuplehash[0].tuple;
+	hash = &data->iphash[ipt_iphash(addr & mask)];
+
+	/* check the saved connections */
+	for (lh = hash->next; lh != hash; lh = lh->next) {
+		conn = list_entry(lh,struct ipt_iplimit_conn,list);
+		found = ip_conntrack_find_get(&conn->tuple,ct);
+		if (0 == memcmp(&conn->tuple,&tuple,sizeof(tuple)) &&
+		    found != NULL) {
+			addit = 0;
+		}
+#if DEBUG
+		printk("ipt_udplimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d\n",
+		       ipt_iphash(addr & mask),
+		       NIPQUAD(conn->tuple.src.ip), ntohs(conn->tuple.src.u.udp.port),
+		       NIPQUAD(conn->tuple.dst.ip), ntohs(conn->tuple.dst.u.udp.port));
+#endif
+		if (NULL == found) {
+			/* this one is gone */
+			lh = lh->prev;
+			list_del(lh->next);
+			kfree(conn);
+			continue;
+		}
+		if ((addr & mask) == (conn->tuple.src.ip & mask)) {
+			/* same source IP address -> be counted! */
+			matches++;
+		}
+		nf_conntrack_put(&found->ctrack->infos[0]);
+	}
+	if (addit) {
+		/* save the new connection in our list */
+#if DEBUG
+		printk("ipt_udplimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d new\n",
+		       ipt_iphash(addr & mask),
+		       NIPQUAD(tuple.src.ip), ntohs(tuple.src.u.tcp.port),
+		       NIPQUAD(tuple.dst.ip), ntohs(tuple.dst.u.tcp.port));
+#endif
+		conn = kmalloc(sizeof(*conn),GFP_ATOMIC);
+		if (NULL == conn)
+			return -1;
+		memset(conn,0,sizeof(*conn));
+		INIT_LIST_HEAD(&conn->list);
+		conn->tuple = tuple;
+		list_add(&conn->list,hash);
+		matches++;
+	}
+	spin_unlock(&data->lock);
+	return matches;
+}
+
+static int
+match(const struct sk_buff *skb,
+      const struct net_device *in,
+      const struct net_device *out,
+      const void *matchinfo,
+      int offset,
+      const void *hdr,
+      u_int16_t datalen,
+      int *hotdrop)
+{
+	const struct ipt_iplimit_info *info = matchinfo;
+	int connections, match;
+	struct ip_conntrack *ct;
+	enum ip_conntrack_info ctinfo;
+
+	ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
+	if (NULL == ct) {
+		printk("ipt_udplimit: Oops: invalid ct state ?\n");
+		*hotdrop = 1;
+		return 0;
+	}
+	connections = count_them(info->data,skb->nh.iph->saddr,info->mask,ct);
+	if (-1 == connections) {
+		printk("ipt_udplimit: Hmm, kmalloc failed :-(\n");
+		*hotdrop = 1; /* let's free some memory :-) */
+		return 0;
+	}
+        match = (info->inverse) ? (connections <= info->limit) : (connections > info->limit);
+#if DEBUG
+	printk("ipt_udplimit: src=%u.%u.%u.%u mask=%u.%u.%u.%u "
+	       "connections=%d limit=%d match=%s\n",
+	       NIPQUAD(skb->nh.iph->saddr), NIPQUAD(info->mask),
+	       connections, info->limit, match ? "yes" : "no");
+#endif
+
+	return match;
+}
+
+static int check(const char *tablename,
+		 const struct ipt_ip *ip,
+		 void *matchinfo,
+		 unsigned int matchsize,
+		 unsigned int hook_mask)
+{
+	struct ipt_iplimit_info *info = matchinfo;
+	int i;
+
+	/* verify size */
+	if (matchsize != IPT_ALIGN(sizeof(struct ipt_iplimit_info)))
+		return 0;
+
+	/* refuse anything but udp */
+	if (ip->proto != IPPROTO_UDP)
+		return 0;
+
+	/* init private data */
+	info->data = kmalloc(sizeof(struct ipt_iplimit_data),GFP_KERNEL);
+	spin_lock_init(&(info->data->lock));
+	for (i = 0; i < 256; i++)
+		INIT_LIST_HEAD(&(info->data->iphash[i]));
+	
+	return 1;
+}
+
+static void destroy(void *matchinfo, unsigned int matchinfosize)
+{
+	struct ipt_iplimit_info *info = matchinfo;
+	struct ipt_iplimit_conn *conn;
+	struct list_head *hash;
+	int i;
+
+	/* cleanup */
+	for (i = 0; i < 256; i++) {
+		hash = &(info->data->iphash[i]);
+		while (hash != hash->next) {
+			conn = list_entry(hash->next,struct ipt_iplimit_conn,list);
+			list_del(hash->next);
+			kfree(conn);
+		}
+	}
+	kfree(info->data);
+}
+
+static struct ipt_match udplimit_match
+= { { NULL, NULL }, "udplimit", &match, &check, &destroy, THIS_MODULE };
+
+static int __init init(void)
+{
+	/* NULL if ip_conntrack not a module */
+	if (ip_conntrack_module)
+		__MOD_INC_USE_COUNT(ip_conntrack_module);
+	return ipt_register_match(&udplimit_match);
+}
+
+static void __exit fini(void)
+{
+	ipt_unregister_match(&udplimit_match);
+	if (ip_conntrack_module)
+		__MOD_DEC_USE_COUNT(ip_conntrack_module);
+}
+
+module_init(init);
+module_exit(fini);

[-- Attachment #3: udplimit.patch.config.in --]
[-- Type: text/plain, Size: 233 bytes --]

    dep_tristate '  Connection state match support' CONFIG_IP_NF_MATCH_STATE $CONFIG_IP_NF_CONNTRACK $CONFIG_IP_NF_IPTABLES 
    dep_tristate '  Connections/UDP limit match support' CONFIG_IP_NF_MATCH_UDPLIMIT $CONFIG_IP_NF_IPTABLES

[-- Attachment #4: udplimit.patch.makefile --]
[-- Type: text/plain, Size: 100 bytes --]

obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
obj-$(CONFIG_IP_NF_MATCH_UDPLIMIT) += ipt_udplimit.o

[-- Attachment #5: udplimit.patch.help --]
[-- Type: text/plain, Size: 724 bytes --]

Author: Gerd Knorr <kraxel@bytesex.org>
	Jan Du Caju <Jan.DuCaju@kuleuven.net> (I just made a shameless copy
	of iplimit of Gerd Knorr ;-)
Status: ItWorksForMe[tm]

This adds CONFIG_IP_NF_MATCH_UDPLIMIT match allows you to restrict the
number of parallel UDP connections to a server per client IP address
(or address block).

Examples:

# allow 5 udp connections per client host
iptables -p udp -m udplimit --udplimit-above 5 -j REJECT

# you can also match the other way around:
iptables -p udp -m udplimit ! --udplimit-above 5 -j ACCEPT

# limit the nr of parallel http requests to 16 per class C sized
# network (24 bit netmask)
iptables -p udp --dport 161 -m udplimit --udplimit-above 16		\
	--iplimit-mask 24 -j REJECT

[-- Attachment #6: udplimit.patch.configure.help --]
[-- Type: text/plain, Size: 332 bytes --]

CONFIG_IP_NF_MATCH_STATE
Connections/UDP limit match support
CONFIG_IP_NF_MATCH_UDPLIMIT
  This match allows you to restrict the number of parallel UDP
  connections to a server per client IP address (or address block).

  If you want to compile it as a module, say M here and read
  Documentation/modules.txt.  If unsure, say `N'.

[-- Attachment #7: libipt_udplimit.c --]
[-- Type: text/x-csrc, Size: 2975 bytes --]

/* Shared library add-on to iptables to add state tracking support. */
#include <stdio.h>
#include <netdb.h>
#include <string.h>
#include <stdlib.h>
#include <stddef.h>
#include <getopt.h>
#include <iptables.h>
#include <linux/netfilter_ipv4/ip_conntrack.h>
#include <linux/netfilter_ipv4/ipt_iplimit.h>

/* Function which prints out usage message. */
static void
help(void)
{
	printf(
"udplimit v%s options:\n"
"[!] --udplimit-above n		match if the number of existing udp connections is (not) above n\n"
" --udplimit-mask n		group hosts using mask\n"
"\n", IPTABLES_VERSION);
}

static struct option opts[] = {
	{ "udplimit-above", 1, 0, '1' },
	{ "udplimit-mask",  1, 0, '2' },
	{0}
};

/* Initialize the match. */
static void
init(struct ipt_entry_match *m, unsigned int *nfcache)
{
	/* Can't cache this */
	*nfcache |= NFC_UNKNOWN;
}

/* Function which parses command options; returns true if it
   ate an option */
static int
parse(int c, char **argv, int invert, unsigned int *flags,
      const struct ipt_entry *entry,
      unsigned int *nfcache,
      struct ipt_entry_match **match)
{
	struct ipt_iplimit_info *info = (struct ipt_iplimit_info*)(*match)->data;

	if (0 == (*flags & 2)) {
		/* set default mask unless we've already seen a mask option */
		info->mask = htonl(0xFFFFFFFF);
	}

	switch (c) {
	case '1':
		check_inverse(optarg, &invert, &optind, 0);
		info->limit = atoi(argv[optind-1]);
		info->inverse = invert;
		*flags |= 1;
		break;

	case '2':
		info->mask = htonl(0xFFFFFFFF << (32 - atoi(argv[optind-1])));
		*flags |= 2;
		break;

	default:
		return 0;
	}

	return 1;
}

/* Final check */
static void final_check(unsigned int flags)
{
	if (!flags & 1)
		exit_error(PARAMETER_PROBLEM, "You must specify `--udplimit-above'");
}

static int
count_bits(u_int32_t mask)
{
	int i, bits;

	for (bits = 0, i = 31; i >= 0; i--) {
		if (mask & htonl((u_int32_t)1 << i)) {
			bits++;
			continue;
		}
		break;
	}
	return bits;
}

/* Prints out the matchinfo. */
static void
print(const struct ipt_ip *ip,
      const struct ipt_entry_match *match,
      int numeric)
{
	struct ipt_iplimit_info *info = (struct ipt_iplimit_info*)match->data;

	printf("#conn/%d %s %d ", count_bits(info->mask),
	       info->inverse ? "<" : ">", info->limit);
}

/* Saves the matchinfo in parsable form to stdout. */
static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
{
	struct ipt_iplimit_info *info = (struct ipt_iplimit_info*)match->data;

	printf("%s--udplimit-above %d ",info->inverse ? "! " : "",info->limit);
	printf("--udplimit-mask %d ",count_bits(info->mask));
}

static struct iptables_match udplimit = {
	name:		"udplimit",
	version:	IPTABLES_VERSION,
	size:		IPT_ALIGN(sizeof(struct ipt_iplimit_info)),
	userspacesize:	offsetof(struct ipt_iplimit_info,data),
	help:		help,
	init:		init,
	parse:		parse,
	final_check:	final_check,
	print:		print,
	save: 		save,
	extra_opts:	opts
};

void _init(void)
{
	register_match(&udplimit);
}

RE: IPLIMIT Patch UDP

[Ing. CIP Alejandro Celi Mariategui]

Thank You very much, Jan and Joel, I will try with udplimit right now!!!

Alex


El vie, 21-02-2003 a las 16:41, Jan Du Caju escribió:
    Hi again,
    
    Jan Du Caju wrote:
     > >  Ing. CIP Alejandro Celi Mariategui wrote:
     > >
     > >  (Sorry, but my english is very bad)
     > >  Hi,
     > >  I compile with p-o-m the server kernel with IPLIMIT Patch by Gerd
     > >  Knorr
     > >  [1]<kraxel@bytesex.org>
     > >  It work fine, i can limit ex: max 10 TCP connections on the server,
     > >  but i want to limit the UDP connections to 10 (max).
     > >  How I can do it?
    
     >    This week I made a updlimit patch (shameless copy of iplimit ;-)
     >    I will post it this afternoon/evening when I have more time (and
     >    a cross post to the netfilter-devel list. Maybe they like it)
    
    In attachment you will find:
     udplimit.patch
     udplimit.patch.config.in
     udplimit.patch.configure.help
     udplimit.patch.help
     udplimit.patch.makefile
    
    put those under <patch-o-matic>/base/ directory
    
    in the <patch-o-matic> directory you run: ./runme base
    (don't forget to select udplimit ;-)
    
    recompile your kernel (with Connections/UDP limit match support
    CONFIG_IP_NF_MATCH_UDPLIMIT ;-)
    
    Place the other file attachment (libipt_udplimit.c) in the directory
    <iptables>/extensions/
    
    in this directory you will also find the file Makefile where you add
    udplimit just after iplimit
    
    recompile iptables
    
    Hope this helps (it works for me :-)
    
    Greetz,
    Jan.
    --------------------------------------------- KULeuvenNet -----
    
    ____________________________________________________________________
    
    diff -urN -x *~ -x [Cc]onfig.* -x Makefile vanilla-2.4.21-pre4/net/ipv4/netfilter/ipt_udplimit.c linux-2.4.21-pre4/net/ipv4/netfilter/ipt_udplimit.c
    --- vanilla-2.4.21-pre4/net/ipv4/netfilter/ipt_udplimit.c	Fri Feb 21 17:20:55 2003
    +++ linux-2.4.21-pre4/net/ipv4/netfilter/ipt_udplimit.c	Fri Feb 21 17:17:38 2003
    @@ -0,0 +1,215 @@
    +/*
    + * netfilter module to limit the number of parallel udp
    + * connections per IP address.
    + * Jan Du Caju <Jan.DuCaju@kuleuven.net>
    + *
    + * based on ...
    + * iplimit (in fact a shameless copy ;-)
    + *   (c) 2000 Gerd Knorr <kraxel@bytesex.org>
    + *   Nov 2002: Martin Bene <martin.bene@icomedias.com>:
    + *		only ignore TIME_WAIT or gone connections
    + *
    + *
    + * Kernel module to match connection tracking information.
    + * GPL (C) 1999  Rusty Russell (rusty@rustcorp.com.au).
    + */
    +#include <linux/module.h>
    +#include <linux/skbuff.h>
    +#include <linux/list.h>
    +#include <linux/netfilter_ipv4/ip_conntrack.h>
    +#include <linux/netfilter_ipv4/ip_conntrack_core.h>
    +#include <linux/netfilter_ipv4/ip_tables.h>
    +#include <linux/netfilter_ipv4/ipt_iplimit.h>
    +
    +#define DEBUG 0
    +
    +MODULE_LICENSE("GPL");
    +
    +/* we'll save the tuples of all connections we care about */
    +struct ipt_iplimit_conn
    +{
    +        struct list_head list;
    +	struct ip_conntrack_tuple tuple;
    +};
    +
    +struct ipt_iplimit_data {
    +	spinlock_t lock;
    +	struct list_head iphash[256];
    +};
    +
    +static int ipt_iphash(u_int32_t addr)
    +{
    +	int hash;
    +
    +	hash  =  addr        & 0xff;
    +	hash ^= (addr >>  8) & 0xff;
    +	hash ^= (addr >> 16) & 0xff;
    +	hash ^= (addr >> 24) & 0xff;
    +	return hash;
    +}
    +
    +static int count_them(struct ipt_iplimit_data *data,
    +		      u_int32_t addr, u_int32_t mask,
    +		      struct ip_conntrack *ct)
    +{
    +	int addit = 1, matches = 0;
    +	struct ip_conntrack_tuple tuple;
    +	struct ip_conntrack_tuple_hash *found;
    +	struct ipt_iplimit_conn *conn;
    +	struct list_head *hash,*lh;
    +
    +	spin_lock(&data->lock);
    +	tuple = ct->tuplehash[0].tuple;
    +	hash = &data->iphash[ipt_iphash(addr & mask)];
    +
    +	/* check the saved connections */
    +	for (lh = hash->next; lh != hash; lh = lh->next) {
    +		conn = list_entry(lh,struct ipt_iplimit_conn,list);
    +		found = ip_conntrack_find_get(&conn->tuple,ct);
    +		if (0 == memcmp(&conn->tuple,&tuple,sizeof(tuple)) &&
    +		    found != NULL) {
    +			addit = 0;
    +		}
    +#if DEBUG
    +		printk("ipt_udplimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d\n",
    +		       ipt_iphash(addr & mask),
    +		       NIPQUAD(conn->tuple.src.ip), ntohs(conn->tuple.src.u.udp.port),
    +		       NIPQUAD(conn->tuple.dst.ip), ntohs(conn->tuple.dst.u.udp.port));
    +#endif
    +		if (NULL == found) {
    +			/* this one is gone */
    +			lh = lh->prev;
    +			list_del(lh->next);
    +			kfree(conn);
    +			continue;
    +		}
    +		if ((addr & mask) == (conn->tuple.src.ip & mask)) {
    +			/* same source IP address -> be counted! */
    +			matches++;
    +		}
    +		nf_conntrack_put(&found->ctrack->infos[0]);
    +	}
    +	if (addit) {
    +		/* save the new connection in our list */
    +#if DEBUG
    +		printk("ipt_udplimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d new\n",
    +		       ipt_iphash(addr & mask),
    +		       NIPQUAD(tuple.src.ip), ntohs(tuple.src.u.tcp.port),
    +		       NIPQUAD(tuple.dst.ip), ntohs(tuple.dst.u.tcp.port));
    +#endif
    +		conn = kmalloc(sizeof(*conn),GFP_ATOMIC);
    +		if (NULL == conn)
    +			return -1;
    +		memset(conn,0,sizeof(*conn));
    +		INIT_LIST_HEAD(&conn->list);
    +		conn->tuple = tuple;
    +		list_add(&conn->list,hash);
    +		matches++;
    +	}
    +	spin_unlock(&data->lock);
    +	return matches;
    +}
    +
    +static int
    +match(const struct sk_buff *skb,
    +      const struct net_device *in,
    +      const struct net_device *out,
    +      const void *matchinfo,
    +      int offset,
    +      const void *hdr,
    +      u_int16_t datalen,
    +      int *hotdrop)
    +{
    +	const struct ipt_iplimit_info *info = matchinfo;
    +	int connections, match;
    +	struct ip_conntrack *ct;
    +	enum ip_conntrack_info ctinfo;
    +
    +	ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
    +	if (NULL == ct) {
    +		printk("ipt_udplimit: Oops: invalid ct state ?\n");
    +		*hotdrop = 1;
    +		return 0;
    +	}
    +	connections = count_them(info->data,skb->nh.iph->saddr,info->mask,ct);
    +	if (-1 == connections) {
    +		printk("ipt_udplimit: Hmm, kmalloc failed :-(\n");
    +		*hotdrop = 1; /* let's free some memory :-) */
    +		return 0;
    +	}
    +        match = (info->inverse) ? (connections <= info->limit) : (connections > info->limit);
    +#if DEBUG
    +	printk("ipt_udplimit: src=%u.%u.%u.%u mask=%u.%u.%u.%u "
    +	       "connections=%d limit=%d match=%s\n",
    +	       NIPQUAD(skb->nh.iph->saddr), NIPQUAD(info->mask),
    +	       connections, info->limit, match ? "yes" : "no");
    +#endif
    +
    +	return match;
    +}
    +
    +static int check(const char *tablename,
    +		 const struct ipt_ip *ip,
    +		 void *matchinfo,
    +		 unsigned int matchsize,
    +		 unsigned int hook_mask)
    +{
    +	struct ipt_iplimit_info *info = matchinfo;
    +	int i;
    +
    +	/* verify size */
    +	if (matchsize != IPT_ALIGN(sizeof(struct ipt_iplimit_info)))
    +		return 0;
    +
    +	/* refuse anything but udp */
    +	if (ip->proto != IPPROTO_UDP)
    +		return 0;
    +
    +	/* init private data */
    +	info->data = kmalloc(sizeof(struct ipt_iplimit_data),GFP_KERNEL);
    +	spin_lock_init(&(info->data->lock));
    +	for (i = 0; i < 256; i++)
    +		INIT_LIST_HEAD(&(info->data->iphash[i]));
    +	
    +	return 1;
    +}
    +
    +static void destroy(void *matchinfo, unsigned int matchinfosize)
    +{
    +	struct ipt_iplimit_info *info = matchinfo;
    +	struct ipt_iplimit_conn *conn;
    +	struct list_head *hash;
    +	int i;
    +
    +	/* cleanup */
    +	for (i = 0; i < 256; i++) {
    +		hash = &(info->data->iphash[i]);
    +		while (hash != hash->next) {
    +			conn = list_entry(hash->next,struct ipt_iplimit_conn,list);
    +			list_del(hash->next);
    +			kfree(conn);
    +		}
    +	}
    +	kfree(info->data);
    +}
    +
    +static struct ipt_match udplimit_match
    += { { NULL, NULL }, "udplimit", &match, &check, &destroy, THIS_MODULE };
    +
    +static int __init init(void)
    +{
    +	/* NULL if ip_conntrack not a module */
    +	if (ip_conntrack_module)
    +		__MOD_INC_USE_COUNT(ip_conntrack_module);
    +	return ipt_register_match(&udplimit_match);
    +}
    +
    +static void __exit fini(void)
    +{
    +	ipt_unregister_match(&udplimit_match);
    +	if (ip_conntrack_module)
    +		__MOD_DEC_USE_COUNT(ip_conntrack_module);
    +}
    +
    +module_init(init);
    +module_exit(fini);
    
    ____________________________________________________________________
    
        dep_tristate '  Connection state match support' CONFIG_IP_NF_MATCH_STATE $CONFIG_IP_NF_CONNTRACK $CONFIG_IP_NF_IPTABLES 
        dep_tristate '  Connections/UDP limit match support' CONFIG_IP_NF_MATCH_UDPLIMIT $CONFIG_IP_NF_IPTABLES
    
    ____________________________________________________________________
    
    obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
    obj-$(CONFIG_IP_NF_MATCH_UDPLIMIT) += ipt_udplimit.o
    
    ____________________________________________________________________
    
    Author: Gerd Knorr <kraxel@bytesex.org>
    	Jan Du Caju <Jan.DuCaju@kuleuven.net> (I just made a shameless copy
    	of iplimit of Gerd Knorr ;-)
    Status: ItWorksForMe[tm]
    
    This adds CONFIG_IP_NF_MATCH_UDPLIMIT match allows you to restrict the
    number of parallel UDP connections to a server per client IP address
    (or address block).
    
    Examples:
    
    # allow 5 udp connections per client host
    iptables -p udp -m udplimit --udplimit-above 5 -j REJECT
    
    # you can also match the other way around:
    iptables -p udp -m udplimit ! --udplimit-above 5 -j ACCEPT
    
    # limit the nr of parallel http requests to 16 per class C sized
    # network (24 bit netmask)
    iptables -p udp --dport 161 -m udplimit --udplimit-above 16		\
    	--iplimit-mask 24 -j REJECT
    
    ____________________________________________________________________
    
    CONFIG_IP_NF_MATCH_STATE
    Connections/UDP limit match support
    CONFIG_IP_NF_MATCH_UDPLIMIT
      This match allows you to restrict the number of parallel UDP
      connections to a server per client IP address (or address block).
    
      If you want to compile it as a module, say M here and read
      Documentation/modules.txt.  If unsure, say `N'.
    
    ____________________________________________________________________
    
    /* Shared library add-on to iptables to add state tracking support. */
    #include <stdio.h>
    #include <netdb.h>
    #include <string.h>
    #include <stdlib.h>
    #include <stddef.h>
    #include <getopt.h>
    #include <iptables.h>
    #include <linux/netfilter_ipv4/ip_conntrack.h>
    #include <linux/netfilter_ipv4/ipt_iplimit.h>
    
    /* Function which prints out usage message. */
    static void
    help(void)
    {
    	printf(
    "udplimit v%s options:\n"
    "[!] --udplimit-above n		match if the number of existing udp connections is (not) above n\n"
    " --udplimit-mask n		group hosts using mask\n"
    "\n", IPTABLES_VERSION);
    }
    
    static struct option opts[] = {
    	{ "udplimit-above", 1, 0, '1' },
    	{ "udplimit-mask",  1, 0, '2' },
    	{0}
    };
    
    /* Initialize the match. */
    static void
    init(struct ipt_entry_match *m, unsigned int *nfcache)
    {
    	/* Can't cache this */
    	*nfcache |= NFC_UNKNOWN;
    }
    
    /* Function which parses command options; returns true if it
       ate an option */
    static int
    parse(int c, char **argv, int invert, unsigned int *flags,
          const struct ipt_entry *entry,
          unsigned int *nfcache,
          struct ipt_entry_match **match)
    {
    	struct ipt_iplimit_info *info = (struct ipt_iplimit_info*)(*match)->data;
    
    	if (0 == (*flags & 2)) {
    		/* set default mask unless we've already seen a mask option */
    		info->mask = htonl(0xFFFFFFFF);
    	}
    
    	switch (c) {
    	case '1':
    		check_inverse(optarg, &invert, &optind, 0);
    		info->limit = atoi(argv[optind-1]);
    		info->inverse = invert;
    		*flags |= 1;
    		break;
    
    	case '2':
    		info->mask = htonl(0xFFFFFFFF << (32 - atoi(argv[optind-1])));
    		*flags |= 2;
    		break;
    
    	default:
    		return 0;
    	}
    
    	return 1;
    }
    
    /* Final check */
    static void final_check(unsigned int flags)
    {
    	if (!flags & 1)
    		exit_error(PARAMETER_PROBLEM, "You must specify `--udplimit-above'");
    }
    
    static int
    count_bits(u_int32_t mask)
    {
    	int i, bits;
    
    	for (bits = 0, i = 31; i >= 0; i--) {
    		if (mask & htonl((u_int32_t)1 << i)) {
    			bits++;
    			continue;
    		}
    		break;
    	}
    	return bits;
    }
    
    /* Prints out the matchinfo. */
    static void
    print(const struct ipt_ip *ip,
          const struct ipt_entry_match *match,
          int numeric)
    {
    	struct ipt_iplimit_info *info = (struct ipt_iplimit_info*)match->data;
    
    	printf("#conn/%d %s %d ", count_bits(info->mask),
    	       info->inverse ? "<" : ">", info->limit);
    }
    
    /* Saves the matchinfo in parsable form to stdout. */
    static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
    {
    	struct ipt_iplimit_info *info = (struct ipt_iplimit_info*)match->data;
    
    	printf("%s--udplimit-above %d ",info->inverse ? "! " : "",info->limit);
    	printf("--udplimit-mask %d ",count_bits(info->mask));
    }
    
    static struct iptables_match udplimit = {
    	name:		"udplimit",
    	version:	IPTABLES_VERSION,
    	size:		IPT_ALIGN(sizeof(struct ipt_iplimit_info)),
    	userspacesize:	offsetof(struct ipt_iplimit_info,data),
    	help:		help,
    	init:		init,
    	parse:		parse,
    	final_check:	final_check,
    	print:		print,
    	save: 		save,
    	extra_opts:	opts
    };
    
    void _init(void)
    {
    	register_match(&udplimit);
    }