1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
From 20c706d4cba3227c9c44fb61c4d93b0ae84e1464 Mon Sep 17 00:00:00 2001
From: Tim Gardner <tim.gardner@canonical.com>
Date: Mon, 1 Mar 2010 19:00:29 -0700
Subject: [PATCH] xt_recent: Added XT_RECENT_REAP logic and man page documentation
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
---
extensions/libxt_recent.c | 20 ++++++++++++++++++++
extensions/libxt_recent.man | 5 +++++
include/linux/netfilter/xt_recent.h | 7 +++++++
3 files changed, 32 insertions(+), 0 deletions(-)
--- a/extensions/libxt_recent.c
+++ b/extensions/libxt_recent.c
@@ -20,6 +20,7 @@ static const struct option recent_opts[]
{.name = "name", .has_arg = true, .val = 208},
{.name = "rsource", .has_arg = false, .val = 209},
{.name = "rdest", .has_arg = false, .val = 210},
+ {.name = "reap", .has_arg = false, .val = 211},
XT_GETOPT_TABLEEND,
};
@@ -37,6 +38,7 @@ static void recent_help(void)
" --hitcount hits For check and update commands above.\n"
" Specifies that the match will only occur if source address seen hits times.\n"
" May be used in conjunction with the seconds option.\n"
+" --reap Remove entries that have expired. Can only be used with --seconds\n"
" --rttl For check and update commands above.\n"
" Specifies that the match will only occur if the source address and the TTL\n"
" match between this packet and the one which was set.\n"
@@ -63,6 +65,8 @@ static void recent_init(struct xt_entry_
(XT_RECENT_SET | XT_RECENT_CHECK | \
XT_RECENT_UPDATE | XT_RECENT_REMOVE)
+#define XT_RECENT_SECONDS 1 << 31
+
static int recent_parse(int c, char **argv, int invert, unsigned int *flags,
const void *entry, struct xt_entry_match **match)
{
@@ -104,6 +108,7 @@ static int recent_parse(int c, char **ar
case 204:
info->seconds = atoi(optarg);
+ *flags |= XT_RECENT_SECONDS;
break;
case 205:
@@ -139,6 +144,11 @@ static int recent_parse(int c, char **ar
info->side = XT_RECENT_DEST;
break;
+ case 211:
+ info->check_set |= XT_RECENT_REAP;
+ *flags |= XT_RECENT_REAP;
+ break;
+
default:
return 0;
}
@@ -157,6 +167,12 @@ static void recent_check(unsigned int fl
xtables_error(PARAMETER_PROBLEM,
"recent: --rttl may only be used with --rcheck or "
"--update");
+ if ((flags & XT_RECENT_REAP) &&
+ ((flags & (XT_RECENT_SET | XT_RECENT_REMOVE)) ||
+ (!(flags & XT_RECENT_SECONDS))))
+ xtables_error(PARAMETER_PROBLEM,
+ "recent: --reap may only be used with --rcheck or "
+ "--update and --seconds");
}
static void recent_print(const void *ip, const struct xt_entry_match *match,
@@ -185,6 +201,8 @@ static void recent_print(const void *ip,
printf("side: source ");
if (info->side == XT_RECENT_DEST)
printf("side: dest ");
+ if (info->check_set & XT_RECENT_REAP)
+ printf("reap ");
}
static void recent_save(const void *ip, const struct xt_entry_match *match)
@@ -211,6 +229,8 @@ static void recent_save(const void *ip,
printf("--rsource ");
if (info->side == XT_RECENT_DEST)
printf("--rdest ");
+ if (info->check_set & XT_RECENT_REAP)
+ printf("--reap ");
}
static struct xtables_match recent_mt_reg = {
--- a/extensions/libxt_recent.man
+++ b/extensions/libxt_recent.man
@@ -41,6 +41,11 @@ This option must be used in conjunction
\fB\-\-update\fP. When used, this will narrow the match to only happen when the
address is in the list and was seen within the last given number of seconds.
.TP
+\fB\-\-reap\fP \fIreap\fP
+This option must be used in conjunction with \fB\-\-seconds\fP. When used, this
+will remove entries with the most recent timestamp older then \fB\-\-seconds\fP
+since the last packet was received.
+.TP
\fB\-\-hitcount\fP \fIhits\fP
This option must be used in conjunction with one of \fB\-\-rcheck\fP or
\fB\-\-update\fP. When used, this will narrow the match to only happen when the
--- a/include/linux/netfilter/xt_recent.h
+++ b/include/linux/netfilter/xt_recent.h
@@ -23,6 +23,9 @@ enum {
#define XT_RECENT_VALID_FLAGS (XT_RECENT_CHECK|XT_RECENT_SET|XT_RECENT_UPDATE|\
XT_RECENT_REMOVE|XT_RECENT_TTL|XT_RECENT_REAP)
+/* Only allowed with --rcheck and --update */
+#define XT_RECENT_MODIFIERS (XT_RECENT_TTL|XT_RECENT_REAP)
+
struct xt_recent_mtinfo {
__u32 seconds;
__u32 hit_count;
|
