Tom Marshall <tommy_at_home.tig-grr.com>

diff --git a/extensions/ebt_limit.c b/extensions/ebt_limit.c
new file mode 100644 (file)
index 0000000..02b8f77
--- /dev/null
+++ b/extensions/ebt_limit.c
@@ -0,0 +1,219 @@
+/* Shared library add-on to ebtables to add limit support.
+ *
+ * Swipted from iptables' limit match.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <getopt.h>
+#include "../include/ebtables_u.h"
+#include <linux/netfilter_bridge/ebt_limit.h>
+
+#define EBT_LIMIT_AVG  "3/hour"
+#define EBT_LIMIT_BURST        5
+
+/* from iptables.c */
+#include <errno.h>
+int
+string_to_number(const char *s, unsigned int min, unsigned int max,
+                unsigned int *ret)
+{
+       long number;
+       char *end;
+
+       /* Handle hex, octal, etc. */
+       errno = 0;
+       number = strtol(s, &end, 0);
+       if (*end == '\0' && end != s) {
+               /* we parsed a number, let's see if we want this */
+               if (errno != ERANGE && min <= number && number <= max) {
+                       *ret = number;
+                       return 0;
+               }
+       }
+       return -1;
+}
+
+#define FLAG_LIMIT             0x01
+#define FLAG_LIMIT_BURST       0x02
+
+#define ARG_LIMIT              '1'
+#define ARG_LIMIT_BURST                '2'
+
+static struct option opts[] =
+{
+       { "limit",              required_argument, 0, ARG_LIMIT },
+       { "limit-burst",        required_argument, 0, ARG_LIMIT_BURST },
+       { 0 }
+};
+
+static void print_help(void)
+{
+       printf(
+"limit options:\n"
+"--limit avg                   max average match rate: default "EBT_LIMIT_AVG"\n"
+"                                [Packets per second unless followed by \n"
+"                                /sec /minute /hour /day postfixes]\n"
+"--limit-burst number          number to match in a burst, -1 < number < 10001,\n"
+"                                default %u\n"
+"\n", EBT_LIMIT_BURST);
+}
+
+static int parse_rate(const char *rate, u_int32_t *val)
+{
+       const char *delim;
+       u_int32_t r;
+       u_int32_t mult = 1;  /* Seconds by default. */
+
+       delim = strchr(rate, '/');
+       if (delim) {
+               if (strlen(delim+1) == 0)
+                       return 0;
+
+               if (strncasecmp(delim+1, "second", strlen(delim+1)) == 0)
+                       mult = 1;
+               else if (strncasecmp(delim+1, "minute", strlen(delim+1)) == 0)
+                       mult = 60;
+               else if (strncasecmp(delim+1, "hour", strlen(delim+1)) == 0)
+                       mult = 60*60;
+               else if (strncasecmp(delim+1, "day", strlen(delim+1)) == 0)
+                       mult = 24*60*60;
+               else
+                       return 0;
+       }
+       r = atoi(rate);
+       if (!r)
+               return 0;
+
+       /* This would get mapped to infinite (1/day is minimum they
+          can specify, so we're ok at that end). */
+       if (r / mult > EBT_LIMIT_SCALE)
+               return 0;
+
+       *val = EBT_LIMIT_SCALE * mult / r;
+       return 1;
+}
+
+/* Initialize the match. */
+static void init(struct ebt_entry_match *m)
+{
+       struct ebt_limit_info *r = (struct ebt_limit_info *)m->data;
+
+       parse_rate(EBT_LIMIT_AVG, &r->avg);
+       r->burst = EBT_LIMIT_BURST;
+}
+
+/* FIXME: handle overflow:
+       if (r->avg*r->burst/r->burst != r->avg)
+               exit_error(PARAMETER_PROBLEM,
+                          "Sorry: burst too large for that avg rate.\n");
+*/
+
+static int parse(int c, char **argv, int argc,
+      const struct ebt_u_entry *entry,
+      unsigned int *flags,
+      struct ebt_entry_match **match)
+{
+       struct ebt_limit_info *r = (struct ebt_limit_info *)(*match)->data;
+       unsigned int num;
+
+       switch(c) {
+       case ARG_LIMIT:
+               check_option(flags, FLAG_LIMIT);
+               if (check_inverse(optarg))
+                       print_error("Unexpected `!' after --limit");
+               if (!parse_rate(optarg, &r->avg))
+                       print_error("bad rate `%s'", optarg);
+               break;
+
+       case ARG_LIMIT_BURST:
+               check_option(flags, FLAG_LIMIT_BURST);
+               if (check_inverse(optarg))
+                       print_error("Unexpected `!' after --limit-burst");
+
+               if (string_to_number(optarg, 0, 10000, &num) == -1)
+                       print_error("bad --limit-burst `%s'", optarg);
+               r->burst = num;
+               break;
+
+       default:
+               return 0;
+       }
+
+       return 1;
+}
+
+static void final_check(unsigned int flags)
+{
+       /* empty */
+}
+
+struct rates
+{
+       const char *name;
+       u_int32_t mult;
+};
+
+static struct rates g_rates[] =
+{
+       { "day", EBT_LIMIT_SCALE*24*60*60 },
+       { "hour", EBT_LIMIT_SCALE*60*60 },
+       { "min", EBT_LIMIT_SCALE*60 },
+       { "sec", EBT_LIMIT_SCALE }
+};
+
+static void print_rate(u_int32_t period)
+{
+       unsigned int i;
+
+       for (i = 1; i < sizeof(g_rates)/sizeof(struct rates); i++)
+               if (period > g_rates[i].mult ||
+                   g_rates[i].mult/period < g_rates[i].mult%period)
+                       break;
+
+       printf("%u/%s ", g_rates[i-1].mult / period, g_rates[i-1].name);
+}
+
+/* Prints out the matchinfo. */
+static void
+print(const struct ebt_u_entry *entry, const struct ebt_entry_match *match)
+{
+       struct ebt_limit_info *r = (struct ebt_limit_info *)match->data;
+
+       printf("limit: avg "); print_rate(r->avg);
+       printf("burst %u ", r->burst);
+}
+
+static int compare(const struct ebt_entry_match* m1, const struct ebt_entry_match *m2)
+{
+       struct ebt_limit_info* li1 = (struct ebt_limit_info*)m1->data;
+       struct ebt_limit_info* li2 = (struct ebt_limit_info*)m2->data;
+
+       if (li1->avg != li2->avg)
+               return 0;
+
+       if (li1->burst != li2->burst)
+               return 0;
+
+       return 1;
+}
+
+static struct ebt_u_match limit_match =
+{
+       .name           EBT_LIMIT_MATCH,
+       .size           sizeof(struct ebt_limit_info),
+       .help           print_help,
+       .init           init,
+       .parse          parse,
+       .final_check    final_check,
+       .print          print,
+       .compare        compare,
+       .extra_ops      opts,
+};
+
+static void _init(void) __attribute((constructor));
+static void _init(void)
+{
+       register_match(&limit_match);
+}