1 From 20c706d4cba3227c9c44fb61c4d93b0ae84e1464 Mon Sep 17 00:00:00 2001
2 From: Tim Gardner <tim.gardner@canonical.com>
3 Date: Mon, 1 Mar 2010 19:00:29 -0700
4 Subject: [PATCH] xt_recent: Added XT_RECENT_REAP logic and man page documentation
6 Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
8 extensions/libxt_recent.c | 20 ++++++++++++++++++++
9 extensions/libxt_recent.man | 5 +++++
10 include/linux/netfilter/xt_recent.h | 7 +++++++
11 3 files changed, 32 insertions(+), 0 deletions(-)
13 --- a/extensions/libxt_recent.c
14 +++ b/extensions/libxt_recent.c
15 @@ -20,6 +20,7 @@ static const struct option recent_opts[]
16 {.name = "name", .has_arg = true, .val = 208},
17 {.name = "rsource", .has_arg = false, .val = 209},
18 {.name = "rdest", .has_arg = false, .val = 210},
19 + {.name = "reap", .has_arg = false, .val = 211},
23 @@ -37,6 +38,7 @@ static void recent_help(void)
24 " --hitcount hits For check and update commands above.\n"
25 " Specifies that the match will only occur if source address seen hits times.\n"
26 " May be used in conjunction with the seconds option.\n"
27 +" --reap Remove entries that have expired. Can only be used with --seconds\n"
28 " --rttl For check and update commands above.\n"
29 " Specifies that the match will only occur if the source address and the TTL\n"
30 " match between this packet and the one which was set.\n"
31 @@ -63,6 +65,8 @@ static void recent_init(struct xt_entry_
32 (XT_RECENT_SET | XT_RECENT_CHECK | \
33 XT_RECENT_UPDATE | XT_RECENT_REMOVE)
35 +#define XT_RECENT_SECONDS 1 << 31
37 static int recent_parse(int c, char **argv, int invert, unsigned int *flags,
38 const void *entry, struct xt_entry_match **match)
40 @@ -104,6 +108,7 @@ static int recent_parse(int c, char **ar
43 info->seconds = atoi(optarg);
44 + *flags |= XT_RECENT_SECONDS;
48 @@ -139,6 +144,11 @@ static int recent_parse(int c, char **ar
49 info->side = XT_RECENT_DEST;
53 + info->check_set |= XT_RECENT_REAP;
54 + *flags |= XT_RECENT_REAP;
60 @@ -157,6 +167,12 @@ static void recent_check(unsigned int fl
61 xtables_error(PARAMETER_PROBLEM,
62 "recent: --rttl may only be used with --rcheck or "
64 + if ((flags & XT_RECENT_REAP) &&
65 + ((flags & (XT_RECENT_SET | XT_RECENT_REMOVE)) ||
66 + (!(flags & XT_RECENT_SECONDS))))
67 + xtables_error(PARAMETER_PROBLEM,
68 + "recent: --reap may only be used with --rcheck or "
69 + "--update and --seconds");
72 static void recent_print(const void *ip, const struct xt_entry_match *match,
73 @@ -185,6 +201,8 @@ static void recent_print(const void *ip,
74 printf("side: source ");
75 if (info->side == XT_RECENT_DEST)
76 printf("side: dest ");
77 + if (info->check_set & XT_RECENT_REAP)
81 static void recent_save(const void *ip, const struct xt_entry_match *match)
82 @@ -211,6 +229,8 @@ static void recent_save(const void *ip,
84 if (info->side == XT_RECENT_DEST)
86 + if (info->check_set & XT_RECENT_REAP)
90 static struct xtables_match recent_mt_reg = {
91 --- a/extensions/libxt_recent.man
92 +++ b/extensions/libxt_recent.man
93 @@ -41,6 +41,11 @@ This option must be used in conjunction
94 \fB\-\-update\fP. When used, this will narrow the match to only happen when the
95 address is in the list and was seen within the last given number of seconds.
97 +\fB\-\-reap\fP \fIreap\fP
98 +This option must be used in conjunction with \fB\-\-seconds\fP. When used, this
99 +will remove entries with the most recent timestamp older then \fB\-\-seconds\fP
100 +since the last packet was received.
102 \fB\-\-hitcount\fP \fIhits\fP
103 This option must be used in conjunction with one of \fB\-\-rcheck\fP or
104 \fB\-\-update\fP. When used, this will narrow the match to only happen when the
105 --- a/include/linux/netfilter/xt_recent.h
106 +++ b/include/linux/netfilter/xt_recent.h
107 @@ -23,6 +23,9 @@ enum {
108 #define XT_RECENT_VALID_FLAGS (XT_RECENT_CHECK|XT_RECENT_SET|XT_RECENT_UPDATE|\
109 XT_RECENT_REMOVE|XT_RECENT_TTL|XT_RECENT_REAP)
111 +/* Only allowed with --rcheck and --update */
112 +#define XT_RECENT_MODIFIERS (XT_RECENT_TTL|XT_RECENT_REAP)
114 struct xt_recent_mtinfo {