![Eric Dumazet](/assets/img/avatar_default.png)
Use "hlist_nulls" infrastructure we added in 2.6.29 for RCUification of UDP & TCP. This permits an easy conversion from call_rcu() based hash lists to a SLAB_DESTROY_BY_RCU one. Avoiding call_rcu() delay at nf_conn freeing time has numerous gains. First, it doesnt fill RCU queues (up to 10000 elements per cpu). This reduces OOM possibility, if queued elements are not taken into account This reduces latency problems when RCU queue size hits hilimit and triggers emergency mode. - It allows fast reuse of just freed elements, permitting better use of CPU cache. - We delete rcu_head from "struct nf_conn", shrinking size of this structure by 8 or 16 bytes. This patch only takes care of "struct nf_conn". call_rcu() is still used for less critical conntrack parts, that may be converted later if necessary. Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
299 lines
7.5 KiB
C
299 lines
7.5 KiB
C
/*
|
|
* netfilter module to limit the number of parallel tcp
|
|
* connections per IP address.
|
|
* (c) 2000 Gerd Knorr <kraxel@bytesex.org>
|
|
* Nov 2002: Martin Bene <martin.bene@icomedias.com>:
|
|
* only ignore TIME_WAIT or gone connections
|
|
* (C) CC Computer Consultants GmbH, 2007
|
|
* Contact: <jengelh@computergmbh.de>
|
|
*
|
|
* based on ...
|
|
*
|
|
* Kernel module to match connection tracking information.
|
|
* GPL (C) 1999 Rusty Russell (rusty@rustcorp.com.au).
|
|
*/
|
|
#include <linux/in.h>
|
|
#include <linux/in6.h>
|
|
#include <linux/ip.h>
|
|
#include <linux/ipv6.h>
|
|
#include <linux/jhash.h>
|
|
#include <linux/list.h>
|
|
#include <linux/module.h>
|
|
#include <linux/random.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/spinlock.h>
|
|
#include <linux/netfilter/nf_conntrack_tcp.h>
|
|
#include <linux/netfilter/x_tables.h>
|
|
#include <linux/netfilter/xt_connlimit.h>
|
|
#include <net/netfilter/nf_conntrack.h>
|
|
#include <net/netfilter/nf_conntrack_core.h>
|
|
#include <net/netfilter/nf_conntrack_tuple.h>
|
|
|
|
/* we will save the tuples of all connections we care about */
|
|
struct xt_connlimit_conn {
|
|
struct list_head list;
|
|
struct nf_conntrack_tuple tuple;
|
|
};
|
|
|
|
struct xt_connlimit_data {
|
|
struct list_head iphash[256];
|
|
spinlock_t lock;
|
|
};
|
|
|
|
static u_int32_t connlimit_rnd;
|
|
static bool connlimit_rnd_inited;
|
|
|
|
static inline unsigned int connlimit_iphash(__be32 addr)
|
|
{
|
|
if (unlikely(!connlimit_rnd_inited)) {
|
|
get_random_bytes(&connlimit_rnd, sizeof(connlimit_rnd));
|
|
connlimit_rnd_inited = true;
|
|
}
|
|
return jhash_1word((__force __u32)addr, connlimit_rnd) & 0xFF;
|
|
}
|
|
|
|
static inline unsigned int
|
|
connlimit_iphash6(const union nf_inet_addr *addr,
|
|
const union nf_inet_addr *mask)
|
|
{
|
|
union nf_inet_addr res;
|
|
unsigned int i;
|
|
|
|
if (unlikely(!connlimit_rnd_inited)) {
|
|
get_random_bytes(&connlimit_rnd, sizeof(connlimit_rnd));
|
|
connlimit_rnd_inited = true;
|
|
}
|
|
|
|
for (i = 0; i < ARRAY_SIZE(addr->ip6); ++i)
|
|
res.ip6[i] = addr->ip6[i] & mask->ip6[i];
|
|
|
|
return jhash2((u32 *)res.ip6, ARRAY_SIZE(res.ip6), connlimit_rnd) & 0xFF;
|
|
}
|
|
|
|
static inline bool already_closed(const struct nf_conn *conn)
|
|
{
|
|
if (nf_ct_protonum(conn) == IPPROTO_TCP)
|
|
return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT ||
|
|
conn->proto.tcp.state == TCP_CONNTRACK_CLOSE;
|
|
else
|
|
return 0;
|
|
}
|
|
|
|
static inline unsigned int
|
|
same_source_net(const union nf_inet_addr *addr,
|
|
const union nf_inet_addr *mask,
|
|
const union nf_inet_addr *u3, u_int8_t family)
|
|
{
|
|
if (family == NFPROTO_IPV4) {
|
|
return (addr->ip & mask->ip) == (u3->ip & mask->ip);
|
|
} else {
|
|
union nf_inet_addr lh, rh;
|
|
unsigned int i;
|
|
|
|
for (i = 0; i < ARRAY_SIZE(addr->ip6); ++i) {
|
|
lh.ip6[i] = addr->ip6[i] & mask->ip6[i];
|
|
rh.ip6[i] = u3->ip6[i] & mask->ip6[i];
|
|
}
|
|
|
|
return memcmp(&lh.ip6, &rh.ip6, sizeof(lh.ip6)) == 0;
|
|
}
|
|
}
|
|
|
|
static int count_them(struct xt_connlimit_data *data,
|
|
const struct nf_conntrack_tuple *tuple,
|
|
const union nf_inet_addr *addr,
|
|
const union nf_inet_addr *mask,
|
|
const struct xt_match *match)
|
|
{
|
|
const struct nf_conntrack_tuple_hash *found;
|
|
struct xt_connlimit_conn *conn;
|
|
struct xt_connlimit_conn *tmp;
|
|
struct nf_conn *found_ct;
|
|
struct list_head *hash;
|
|
bool addit = true;
|
|
int matches = 0;
|
|
|
|
|
|
if (match->family == NFPROTO_IPV6)
|
|
hash = &data->iphash[connlimit_iphash6(addr, mask)];
|
|
else
|
|
hash = &data->iphash[connlimit_iphash(addr->ip & mask->ip)];
|
|
|
|
rcu_read_lock();
|
|
|
|
/* check the saved connections */
|
|
list_for_each_entry_safe(conn, tmp, hash, list) {
|
|
found = nf_conntrack_find_get(&init_net, &conn->tuple);
|
|
found_ct = NULL;
|
|
|
|
if (found != NULL)
|
|
found_ct = nf_ct_tuplehash_to_ctrack(found);
|
|
|
|
if (found_ct != NULL &&
|
|
nf_ct_tuple_equal(&conn->tuple, tuple) &&
|
|
!already_closed(found_ct))
|
|
/*
|
|
* Just to be sure we have it only once in the list.
|
|
* We should not see tuples twice unless someone hooks
|
|
* this into a table without "-p tcp --syn".
|
|
*/
|
|
addit = false;
|
|
|
|
if (found == NULL) {
|
|
/* this one is gone */
|
|
list_del(&conn->list);
|
|
kfree(conn);
|
|
continue;
|
|
}
|
|
|
|
if (already_closed(found_ct)) {
|
|
/*
|
|
* we do not care about connections which are
|
|
* closed already -> ditch it
|
|
*/
|
|
nf_ct_put(found_ct);
|
|
list_del(&conn->list);
|
|
kfree(conn);
|
|
continue;
|
|
}
|
|
|
|
if (same_source_net(addr, mask, &conn->tuple.src.u3,
|
|
match->family))
|
|
/* same source network -> be counted! */
|
|
++matches;
|
|
nf_ct_put(found_ct);
|
|
}
|
|
|
|
rcu_read_unlock();
|
|
|
|
if (addit) {
|
|
/* save the new connection in our list */
|
|
conn = kzalloc(sizeof(*conn), GFP_ATOMIC);
|
|
if (conn == NULL)
|
|
return -ENOMEM;
|
|
conn->tuple = *tuple;
|
|
list_add(&conn->list, hash);
|
|
++matches;
|
|
}
|
|
|
|
return matches;
|
|
}
|
|
|
|
static bool
|
|
connlimit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
|
|
{
|
|
const struct xt_connlimit_info *info = par->matchinfo;
|
|
union nf_inet_addr addr;
|
|
struct nf_conntrack_tuple tuple;
|
|
const struct nf_conntrack_tuple *tuple_ptr = &tuple;
|
|
enum ip_conntrack_info ctinfo;
|
|
const struct nf_conn *ct;
|
|
int connections;
|
|
|
|
ct = nf_ct_get(skb, &ctinfo);
|
|
if (ct != NULL)
|
|
tuple_ptr = &ct->tuplehash[0].tuple;
|
|
else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
|
|
par->family, &tuple))
|
|
goto hotdrop;
|
|
|
|
if (par->family == NFPROTO_IPV6) {
|
|
const struct ipv6hdr *iph = ipv6_hdr(skb);
|
|
memcpy(&addr.ip6, &iph->saddr, sizeof(iph->saddr));
|
|
} else {
|
|
const struct iphdr *iph = ip_hdr(skb);
|
|
addr.ip = iph->saddr;
|
|
}
|
|
|
|
spin_lock_bh(&info->data->lock);
|
|
connections = count_them(info->data, tuple_ptr, &addr,
|
|
&info->mask, par->match);
|
|
spin_unlock_bh(&info->data->lock);
|
|
|
|
if (connections < 0) {
|
|
/* kmalloc failed, drop it entirely */
|
|
*par->hotdrop = true;
|
|
return false;
|
|
}
|
|
|
|
return (connections > info->limit) ^ info->inverse;
|
|
|
|
hotdrop:
|
|
*par->hotdrop = true;
|
|
return false;
|
|
}
|
|
|
|
static bool connlimit_mt_check(const struct xt_mtchk_param *par)
|
|
{
|
|
struct xt_connlimit_info *info = par->matchinfo;
|
|
unsigned int i;
|
|
|
|
if (nf_ct_l3proto_try_module_get(par->family) < 0) {
|
|
printk(KERN_WARNING "cannot load conntrack support for "
|
|
"address family %u\n", par->family);
|
|
return false;
|
|
}
|
|
|
|
/* init private data */
|
|
info->data = kmalloc(sizeof(struct xt_connlimit_data), GFP_KERNEL);
|
|
if (info->data == NULL) {
|
|
nf_ct_l3proto_module_put(par->family);
|
|
return false;
|
|
}
|
|
|
|
spin_lock_init(&info->data->lock);
|
|
for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i)
|
|
INIT_LIST_HEAD(&info->data->iphash[i]);
|
|
|
|
return true;
|
|
}
|
|
|
|
static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)
|
|
{
|
|
const struct xt_connlimit_info *info = par->matchinfo;
|
|
struct xt_connlimit_conn *conn;
|
|
struct xt_connlimit_conn *tmp;
|
|
struct list_head *hash = info->data->iphash;
|
|
unsigned int i;
|
|
|
|
nf_ct_l3proto_module_put(par->family);
|
|
|
|
for (i = 0; i < ARRAY_SIZE(info->data->iphash); ++i) {
|
|
list_for_each_entry_safe(conn, tmp, &hash[i], list) {
|
|
list_del(&conn->list);
|
|
kfree(conn);
|
|
}
|
|
}
|
|
|
|
kfree(info->data);
|
|
}
|
|
|
|
static struct xt_match connlimit_mt_reg __read_mostly = {
|
|
.name = "connlimit",
|
|
.revision = 0,
|
|
.family = NFPROTO_UNSPEC,
|
|
.checkentry = connlimit_mt_check,
|
|
.match = connlimit_mt,
|
|
.matchsize = sizeof(struct xt_connlimit_info),
|
|
.destroy = connlimit_mt_destroy,
|
|
.me = THIS_MODULE,
|
|
};
|
|
|
|
static int __init connlimit_mt_init(void)
|
|
{
|
|
return xt_register_match(&connlimit_mt_reg);
|
|
}
|
|
|
|
static void __exit connlimit_mt_exit(void)
|
|
{
|
|
xt_unregister_match(&connlimit_mt_reg);
|
|
}
|
|
|
|
module_init(connlimit_mt_init);
|
|
module_exit(connlimit_mt_exit);
|
|
MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
|
|
MODULE_DESCRIPTION("Xtables: Number of connections matching");
|
|
MODULE_LICENSE("GPL");
|
|
MODULE_ALIAS("ipt_connlimit");
|
|
MODULE_ALIAS("ip6t_connlimit");
|