From 0fb106cc3f40524759012ac12baf28dccec9e571 Mon Sep 17 00:00:00 2001
From: luigi <luigi@FreeBSD.org>
Date: Thu, 27 Sep 2001 23:44:27 +0000
Subject: Two main changes here:  + implement "limit" rules, which permit to
 limit the number of sessions    between certain host pairs (according to
 masks). These are a special    type of stateful rules, which might be of
 interest in some cases.    See the ipfw manpage for details.

 + merge the list pointers and ipfw rule descriptors in the kernel, so
   the code is smaller, faster and more readable. This patch basically
   consists in replacing "foo->rule->bar" with "rule->bar" all over
   the place.
   I have been willing to do this for ages!

MFC after: 1 week
---
 sbin/ipfw/ipfw.c | 80 ++++++++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 61 insertions(+), 19 deletions(-)

(limited to 'sbin/ipfw/ipfw.c')

diff --git a/sbin/ipfw/ipfw.c b/sbin/ipfw/ipfw.c
index ba5d36c..c7fa1d5 100644
--- a/sbin/ipfw/ipfw.c
+++ b/sbin/ipfw/ipfw.c
@@ -168,6 +168,18 @@ print_reject_code(int code)
 	printf("%u", code);
 }
 
+/**
+ * _s_x holds a string-int pair for various lookups.
+ * s=NULL terminates the struct.
+ */
+struct _s_x { char *s; int x; };
+static struct _s_x limit_masks[] = {
+	{"src-addr",    DYN_SRC_ADDR},
+	{"src-port",    DYN_SRC_PORT},
+	{"dst-addr",    DYN_DST_ADDR},
+	{"dst-port",    DYN_DST_PORT},
+	{NULL,          0} };
+
 static void
 show_ipfw(struct ip_fw *chain)
 {
@@ -204,7 +216,7 @@ show_ipfw(struct ip_fw *chain)
 	}
 
 	if (chain->fw_flg & IP_FW_F_RND_MATCH) {
-		double d = 1.0 * (int)(chain->pipe_ptr);
+		double d = 1.0 * chain->dont_match_prob;
 		d = 1 - (d / 0x7fffffff);
 		printf("prob %f ", d);
 	}
@@ -373,16 +385,22 @@ show_ipfw(struct ip_fw *chain)
 	}
 
 	if (chain->fw_flg & IP_FW_F_KEEP_S) {
-	    u_long x = (u_long)chain->next_rule_ptr;
-	    u_char type = (x) & 0xff ;
+	    struct _s_x *p = limit_masks;
 
-	    switch(type) {
+	    switch(chain->dyn_type) {
 	    default:
 		printf(" *** unknown type ***");
 		break ;
 	    case DYN_KEEP_STATE:
 		printf(" keep-state");
 		break;
+	    case DYN_LIMIT:
+		printf(" limit");
+		for ( ; p->s != NULL ; p++)
+		    if (chain->limit_mask & p->x)
+			printf(" %s", p->s);
+		printf(" %d", chain->conn_limit);
+		break ;
 	    }
 	}
 	/* Direction */
@@ -573,11 +591,17 @@ show_dyn_ipfw(struct ipfw_dyn_rule *d)
 		return;
 	
 	printf("%05d %qu %qu (T %ds, slot %d)",
-	    (int)(d->chain),
+	    (int)(d->rule),
 	    d->pcnt, d->bcnt,
 	    d->expire,
 	    d->bucket);
 	switch (d->dyn_type) {
+	case DYN_LIMIT_PARENT:
+	    printf(" PARENT %d", d->count);
+	    break;
+	case DYN_LIMIT:
+	    printf(" LIMIT");
+	    break;
 	case DYN_KEEP_STATE: /* bidir, no mask */
 	    printf(" <->");
 	    break;
@@ -589,17 +613,10 @@ show_dyn_ipfw(struct ipfw_dyn_rule *d)
 		printf(" %u,", d->id.proto);
 		
 	a.s_addr = htonl(d->id.src_ip);
-	printf(" %s", inet_ntoa(a));
-	printf(" %d", d->id.src_port);
+	printf(" %si %d", inet_ntoa(a), d->id.src_port);
 	
-	switch (d->dyn_type) {
-	default: /* bidir, no mask */
-		printf(" <->");
-		break;
-	}
 	a.s_addr = htonl(d->id.dst_ip);
-	printf(" %s", inet_ntoa(a));
-	printf(" %d", d->id.dst_port);
+	printf("<-> %s %d", inet_ntoa(a), d->id.dst_port);
 	printf("\n");
 }
 
@@ -864,9 +881,9 @@ list(int ac, char *av[])
 				/* already warned */
 				continue;
 			for (n = 0, d = dynrules; n < ndyn; n++, d++) {
-				if ((int)(d->chain) > rnum)
+				if ((int)(d->rule) > rnum)
 					break;
-				if ((int)(d->chain) == rnum)
+				if ((int)(d->rule) == rnum)
 					show_dyn_ipfw(d);
 			}
 		}
@@ -1714,8 +1731,7 @@ add(int ac, char *av[])
 			errx(EX_DATAERR, "illegal match prob. %s", av[1]);
 		if (d != 1) { /* 1 means always match */
 			rule.fw_flg |= IP_FW_F_RND_MATCH;
-			/* we really store dont_match probability */
-			(long)rule.pipe_ptr = (long)((1 - d) * 0x7fffffff);
+			rule.dont_match_prob = (long)((1 - d) * 0x7fffffff);
 		}
 		av += 2; ac -= 2;
 	}
@@ -1976,13 +1992,39 @@ add(int ac, char *av[])
 		} else if (!strncmp(*av, "in", strlen(*av))) {
 			rule.fw_flg |= IP_FW_F_IN;
 			av++; ac--;
+		} else if (!strncmp(*av,"limit",strlen(*av))) {
+		    /* keep-state rules used to limit number of connections. */
+		    rule.fw_flg |= IP_FW_F_KEEP_S;
+		    rule.dyn_type = DYN_LIMIT ;
+		    rule.limit_mask = 0 ;
+		    av++; ac--;
+		    for (; ac >1 ;) {
+			struct _s_x *p = limit_masks;
+			int found = 0;
+			for ( ; p->s != NULL ; p++)
+			    if (!strncmp(*av, p->s, strlen(*av))) {
+				rule.limit_mask |= p->x ;
+				av++; ac-- ;
+			    }
+			if (found == 0) {
+			    if (rule.limit_mask == 0)
+				errx(EX_USAGE, "missing limit mask");
+			    break ;
+			}
+		    }
+		    if (ac < 1)
+			errx(EX_USAGE, "limit needs mask and # of connections");
+		    rule.conn_limit = atoi(*av);
+		    if (rule.conn_limit == 0)
+			errx(EX_USAGE, "limit: limit must be >0");
+		    av++; ac--;
 		} else if (!strncmp(*av, "keep-state", strlen(*av))) {
 			u_long type;
 			rule.fw_flg |= IP_FW_F_KEEP_S;
 
 			av++; ac--;
 			if (ac > 0 && (type = atoi(*av)) != 0) {
-			    (int)rule.next_rule_ptr = type;
+			    rule.dyn_type = type;
 			    av++; ac--;
 			}
 		} else if (!strncmp(*av, "bridged", strlen(*av))) {
-- 
cgit v1.1