xt_hashlimit.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 *	xt_hashlimit - Netfilter module to limit the number of packets per time
   4 *	separately for each hashbucket (sourceip/sourceport/dstip/dstport)
   5 *
   6 *	(C) 2003-2004 by Harald Welte <laforge@netfilter.org>
   7 *	(C) 2006-2012 Patrick McHardy <kaber@trash.net>
   8 *	Copyright © CC Computer Consultants GmbH, 2007 - 2008
   9 *
  10 * Development of this code was funded by Astaro AG, http://www.astaro.com/
  11 */
  12#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  13#include <linux/module.h>
  14#include <linux/spinlock.h>
  15#include <linux/random.h>
  16#include <linux/jhash.h>
  17#include <linux/slab.h>
  18#include <linux/proc_fs.h>
  19#include <linux/seq_file.h>
  20#include <linux/list.h>
  21#include <linux/skbuff.h>
  22#include <linux/mm.h>
  23#include <linux/in.h>
  24#include <linux/ip.h>
  25#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
  26#include <linux/ipv6.h>
  27#include <net/ipv6.h>
  28#endif
  29
  30#include <net/net_namespace.h>
  31#include <net/netns/generic.h>
  32
  33#include <linux/netfilter/x_tables.h>
  34#include <linux/netfilter_ipv4/ip_tables.h>
  35#include <linux/netfilter_ipv6/ip6_tables.h>
  36#include <linux/mutex.h>
  37#include <linux/kernel.h>
  38#include <linux/refcount.h>
  39#include <uapi/linux/netfilter/xt_hashlimit.h>
  40
  41#define XT_HASHLIMIT_ALL (XT_HASHLIMIT_HASH_DIP | XT_HASHLIMIT_HASH_DPT | \
  42			  XT_HASHLIMIT_HASH_SIP | XT_HASHLIMIT_HASH_SPT | \
  43			  XT_HASHLIMIT_INVERT | XT_HASHLIMIT_BYTES |\
  44			  XT_HASHLIMIT_RATE_MATCH)
  45
  46MODULE_LICENSE("GPL");
  47MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
  48MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
  49MODULE_DESCRIPTION("Xtables: per hash-bucket rate-limit match");
  50MODULE_ALIAS("ipt_hashlimit");
  51MODULE_ALIAS("ip6t_hashlimit");
  52
  53struct hashlimit_net {
  54	struct hlist_head	htables;
  55	struct proc_dir_entry	*ipt_hashlimit;
  56	struct proc_dir_entry	*ip6t_hashlimit;
  57};
  58
  59static unsigned int hashlimit_net_id;
  60static inline struct hashlimit_net *hashlimit_pernet(struct net *net)
  61{
  62	return net_generic(net, hashlimit_net_id);
  63}
  64
  65/* need to declare this at the top */
  66static const struct seq_operations dl_seq_ops_v2;
  67static const struct seq_operations dl_seq_ops_v1;
  68static const struct seq_operations dl_seq_ops;
  69
  70/* hash table crap */
  71struct dsthash_dst {
  72	union {
  73		struct {
  74			__be32 src;
  75			__be32 dst;
  76		} ip;
  77#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
  78		struct {
  79			__be32 src[4];
  80			__be32 dst[4];
  81		} ip6;
  82#endif
  83	};
  84	__be16 src_port;
  85	__be16 dst_port;
  86};
  87
  88struct dsthash_ent {
  89	/* static / read-only parts in the beginning */
  90	struct hlist_node node;
  91	struct dsthash_dst dst;
  92
  93	/* modified structure members in the end */
  94	spinlock_t lock;
  95	unsigned long expires;		/* precalculated expiry time */
  96	struct {
  97		unsigned long prev;	/* last modification */
  98		union {
  99			struct {
 100				u_int64_t credit;
 101				u_int64_t credit_cap;
 102				u_int64_t cost;
 103			};
 104			struct {
 105				u_int32_t interval, prev_window;
 106				u_int64_t current_rate;
 107				u_int64_t rate;
 108				int64_t burst;
 109			};
 110		};
 111	} rateinfo;
 112	struct rcu_head rcu;
 113};
 114
 115struct xt_hashlimit_htable {
 116	struct hlist_node node;		/* global list of all htables */
 117	refcount_t use;
 118	u_int8_t family;
 119	bool rnd_initialized;
 120
 121	struct hashlimit_cfg3 cfg;	/* config */
 122
 123	/* used internally */
 124	spinlock_t lock;		/* lock for list_head */
 125	u_int32_t rnd;			/* random seed for hash */
 126	unsigned int count;		/* number entries in table */
 127	struct delayed_work gc_work;
 128
 129	/* seq_file stuff */
 130	struct proc_dir_entry *pde;
 131	const char *name;
 132	struct net *net;
 133
 134	struct hlist_head hash[];	/* hashtable itself */
 135};
 136
 137static int
 138cfg_copy(struct hashlimit_cfg3 *to, const void *from, int revision)
 139{
 140	if (revision == 1) {
 141		struct hashlimit_cfg1 *cfg = (struct hashlimit_cfg1 *)from;
 142
 143		to->mode = cfg->mode;
 144		to->avg = cfg->avg;
 145		to->burst = cfg->burst;
 146		to->size = cfg->size;
 147		to->max = cfg->max;
 148		to->gc_interval = cfg->gc_interval;
 149		to->expire = cfg->expire;
 150		to->srcmask = cfg->srcmask;
 151		to->dstmask = cfg->dstmask;
 152	} else if (revision == 2) {
 153		struct hashlimit_cfg2 *cfg = (struct hashlimit_cfg2 *)from;
 154
 155		to->mode = cfg->mode;
 156		to->avg = cfg->avg;
 157		to->burst = cfg->burst;
 158		to->size = cfg->size;
 159		to->max = cfg->max;
 160		to->gc_interval = cfg->gc_interval;
 161		to->expire = cfg->expire;
 162		to->srcmask = cfg->srcmask;
 163		to->dstmask = cfg->dstmask;
 164	} else if (revision == 3) {
 165		memcpy(to, from, sizeof(struct hashlimit_cfg3));
 166	} else {
 167		return -EINVAL;
 168	}
 169
 170	return 0;
 171}
 172
 173static DEFINE_MUTEX(hashlimit_mutex);	/* protects htables list */
 174static struct kmem_cache *hashlimit_cachep __read_mostly;
 175
 176static inline bool dst_cmp(const struct dsthash_ent *ent,
 177			   const struct dsthash_dst *b)
 178{
 179	return !memcmp(&ent->dst, b, sizeof(ent->dst));
 180}
 181
 182static u_int32_t
 183hash_dst(const struct xt_hashlimit_htable *ht, const struct dsthash_dst *dst)
 184{
 185	u_int32_t hash = jhash2((const u32 *)dst,
 186				sizeof(*dst)/sizeof(u32),
 187				ht->rnd);
 188	/*
 189	 * Instead of returning hash % ht->cfg.size (implying a divide)
 190	 * we return the high 32 bits of the (hash * ht->cfg.size) that will
 191	 * give results between [0 and cfg.size-1] and same hash distribution,
 192	 * but using a multiply, less expensive than a divide
 193	 */
 194	return reciprocal_scale(hash, ht->cfg.size);
 195}
 196
 197static struct dsthash_ent *
 198dsthash_find(const struct xt_hashlimit_htable *ht,
 199	     const struct dsthash_dst *dst)
 200{
 201	struct dsthash_ent *ent;
 202	u_int32_t hash = hash_dst(ht, dst);
 203
 204	if (!hlist_empty(&ht->hash[hash])) {
 205		hlist_for_each_entry_rcu(ent, &ht->hash[hash], node)
 206			if (dst_cmp(ent, dst)) {
 207				spin_lock(&ent->lock);
 208				return ent;
 209			}
 210	}
 211	return NULL;
 212}
 213
 214/* allocate dsthash_ent, initialize dst, put in htable and lock it */
 215static struct dsthash_ent *
 216dsthash_alloc_init(struct xt_hashlimit_htable *ht,
 217		   const struct dsthash_dst *dst, bool *race)
 218{
 219	struct dsthash_ent *ent;
 220
 221	spin_lock(&ht->lock);
 222
 223	/* Two or more packets may race to create the same entry in the
 224	 * hashtable, double check if this packet lost race.
 225	 */
 226	ent = dsthash_find(ht, dst);
 227	if (ent != NULL) {
 228		spin_unlock(&ht->lock);
 229		*race = true;
 230		return ent;
 231	}
 232
 233	/* initialize hash with random val at the time we allocate
 234	 * the first hashtable entry */
 235	if (unlikely(!ht->rnd_initialized)) {
 236		get_random_bytes(&ht->rnd, sizeof(ht->rnd));
 237		ht->rnd_initialized = true;
 238	}
 239
 240	if (ht->cfg.max && ht->count >= ht->cfg.max) {
 241		/* FIXME: do something. question is what.. */
 242		net_err_ratelimited("max count of %u reached\n", ht->cfg.max);
 243		ent = NULL;
 244	} else
 245		ent = kmem_cache_alloc(hashlimit_cachep, GFP_ATOMIC);
 246	if (ent) {
 247		memcpy(&ent->dst, dst, sizeof(ent->dst));
 248		spin_lock_init(&ent->lock);
 249
 250		spin_lock(&ent->lock);
 251		hlist_add_head_rcu(&ent->node, &ht->hash[hash_dst(ht, dst)]);
 252		ht->count++;
 253	}
 254	spin_unlock(&ht->lock);
 255	return ent;
 256}
 257
 258static void dsthash_free_rcu(struct rcu_head *head)
 259{
 260	struct dsthash_ent *ent = container_of(head, struct dsthash_ent, rcu);
 261
 262	kmem_cache_free(hashlimit_cachep, ent);
 263}
 264
 265static inline void
 266dsthash_free(struct xt_hashlimit_htable *ht, struct dsthash_ent *ent)
 267{
 268	hlist_del_rcu(&ent->node);
 269	call_rcu(&ent->rcu, dsthash_free_rcu);
 270	ht->count--;
 271}
 272static void htable_gc(struct work_struct *work);
 273
 274static int htable_create(struct net *net, struct hashlimit_cfg3 *cfg,
 275			 const char *name, u_int8_t family,
 276			 struct xt_hashlimit_htable **out_hinfo,
 277			 int revision)
 278{
 279	struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
 280	struct xt_hashlimit_htable *hinfo;
 281	const struct seq_operations *ops;
 282	unsigned int size, i;
 283	unsigned long nr_pages = totalram_pages();
 284	int ret;
 285
 286	if (cfg->size) {
 287		size = cfg->size;
 288	} else {
 289		size = (nr_pages << PAGE_SHIFT) / 16384 /
 290		       sizeof(struct hlist_head);
 291		if (nr_pages > 1024 * 1024 * 1024 / PAGE_SIZE)
 292			size = 8192;
 293		if (size < 16)
 294			size = 16;
 295	}
 296	hinfo = kvmalloc(struct_size(hinfo, hash, size), GFP_KERNEL);
 297	if (hinfo == NULL)
 298		return -ENOMEM;
 299	*out_hinfo = hinfo;
 300
 301	/* copy match config into hashtable config */
 302	ret = cfg_copy(&hinfo->cfg, (void *)cfg, 3);
 303	if (ret) {
 304		kvfree(hinfo);
 305		return ret;
 306	}
 307
 308	hinfo->cfg.size = size;
 309	if (hinfo->cfg.max == 0)
 310		hinfo->cfg.max = 8 * hinfo->cfg.size;
 311	else if (hinfo->cfg.max < hinfo->cfg.size)
 312		hinfo->cfg.max = hinfo->cfg.size;
 313
 314	for (i = 0; i < hinfo->cfg.size; i++)
 315		INIT_HLIST_HEAD(&hinfo->hash[i]);
 316
 317	refcount_set(&hinfo->use, 1);
 318	hinfo->count = 0;
 319	hinfo->family = family;
 320	hinfo->rnd_initialized = false;
 321	hinfo->name = kstrdup(name, GFP_KERNEL);
 322	if (!hinfo->name) {
 323		kvfree(hinfo);
 324		return -ENOMEM;
 325	}
 326	spin_lock_init(&hinfo->lock);
 327
 328	switch (revision) {
 329	case 1:
 330		ops = &dl_seq_ops_v1;
 331		break;
 332	case 2:
 333		ops = &dl_seq_ops_v2;
 334		break;
 335	default:
 336		ops = &dl_seq_ops;
 337	}
 338
 339	hinfo->pde = proc_create_seq_data(name, 0,
 340		(family == NFPROTO_IPV4) ?
 341		hashlimit_net->ipt_hashlimit : hashlimit_net->ip6t_hashlimit,
 342		ops, hinfo);
 343	if (hinfo->pde == NULL) {
 344		kfree(hinfo->name);
 345		kvfree(hinfo);
 346		return -ENOMEM;
 347	}
 348	hinfo->net = net;
 349
 350	INIT_DEFERRABLE_WORK(&hinfo->gc_work, htable_gc);
 351	queue_delayed_work(system_power_efficient_wq, &hinfo->gc_work,
 352			   msecs_to_jiffies(hinfo->cfg.gc_interval));
 353
 354	hlist_add_head(&hinfo->node, &hashlimit_net->htables);
 355
 356	return 0;
 357}
 358
 359static void htable_selective_cleanup(struct xt_hashlimit_htable *ht, bool select_all)
 360{
 361	unsigned int i;
 362
 363	for (i = 0; i < ht->cfg.size; i++) {
 364		struct hlist_head *head = &ht->hash[i];
 365		struct dsthash_ent *dh;
 366		struct hlist_node *n;
 367
 368		if (hlist_empty(head))
 369			continue;
 370
 371		spin_lock_bh(&ht->lock);
 372		hlist_for_each_entry_safe(dh, n, head, node) {
 373			if (time_after_eq(jiffies, dh->expires) || select_all)
 374				dsthash_free(ht, dh);
 375		}
 376		spin_unlock_bh(&ht->lock);
 377		cond_resched();
 378	}
 379}
 380
 381static void htable_gc(struct work_struct *work)
 382{
 383	struct xt_hashlimit_htable *ht;
 384
 385	ht = container_of(work, struct xt_hashlimit_htable, gc_work.work);
 386
 387	htable_selective_cleanup(ht, false);
 388
 389	queue_delayed_work(system_power_efficient_wq,
 390			   &ht->gc_work, msecs_to_jiffies(ht->cfg.gc_interval));
 391}
 392
 393static void htable_remove_proc_entry(struct xt_hashlimit_htable *hinfo)
 394{
 395	struct hashlimit_net *hashlimit_net = hashlimit_pernet(hinfo->net);
 396	struct proc_dir_entry *parent;
 397
 398	if (hinfo->family == NFPROTO_IPV4)
 399		parent = hashlimit_net->ipt_hashlimit;
 400	else
 401		parent = hashlimit_net->ip6t_hashlimit;
 402
 403	if (parent != NULL)
 404		remove_proc_entry(hinfo->name, parent);
 405}
 406
 407static struct xt_hashlimit_htable *htable_find_get(struct net *net,
 408						   const char *name,
 409						   u_int8_t family)
 410{
 411	struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
 412	struct xt_hashlimit_htable *hinfo;
 413
 414	hlist_for_each_entry(hinfo, &hashlimit_net->htables, node) {
 415		if (!strcmp(name, hinfo->name) &&
 416		    hinfo->family == family) {
 417			refcount_inc(&hinfo->use);
 418			return hinfo;
 419		}
 420	}
 421	return NULL;
 422}
 423
 424static void htable_put(struct xt_hashlimit_htable *hinfo)
 425{
 426	if (refcount_dec_and_mutex_lock(&hinfo->use, &hashlimit_mutex)) {
 427		hlist_del(&hinfo->node);
 428		htable_remove_proc_entry(hinfo);
 429		mutex_unlock(&hashlimit_mutex);
 430
 431		cancel_delayed_work_sync(&hinfo->gc_work);
 432		htable_selective_cleanup(hinfo, true);
 433		kfree(hinfo->name);
 434		kvfree(hinfo);
 435	}
 436}
 437
 438/* The algorithm used is the Simple Token Bucket Filter (TBF)
 439 * see net/sched/sch_tbf.c in the linux source tree
 440 */
 441
 442/* Rusty: This is my (non-mathematically-inclined) understanding of
 443   this algorithm.  The `average rate' in jiffies becomes your initial
 444   amount of credit `credit' and the most credit you can ever have
 445   `credit_cap'.  The `peak rate' becomes the cost of passing the
 446   test, `cost'.
 447
 448   `prev' tracks the last packet hit: you gain one credit per jiffy.
 449   If you get credit balance more than this, the extra credit is
 450   discarded.  Every time the match passes, you lose `cost' credits;
 451   if you don't have that many, the test fails.
 452
 453   See Alexey's formal explanation in net/sched/sch_tbf.c.
 454
 455   To get the maximum range, we multiply by this factor (ie. you get N
 456   credits per jiffy).  We want to allow a rate as low as 1 per day
 457   (slowest userspace tool allows), which means
 458   CREDITS_PER_JIFFY*HZ*60*60*24 < 2^32 ie.
 459*/
 460#define MAX_CPJ_v1 (0xFFFFFFFF / (HZ*60*60*24))
 461#define MAX_CPJ (0xFFFFFFFFFFFFFFFFULL / (HZ*60*60*24))
 462
 463/* Repeated shift and or gives us all 1s, final shift and add 1 gives
 464 * us the power of 2 below the theoretical max, so GCC simply does a
 465 * shift. */
 466#define _POW2_BELOW2(x) ((x)|((x)>>1))
 467#define _POW2_BELOW4(x) (_POW2_BELOW2(x)|_POW2_BELOW2((x)>>2))
 468#define _POW2_BELOW8(x) (_POW2_BELOW4(x)|_POW2_BELOW4((x)>>4))
 469#define _POW2_BELOW16(x) (_POW2_BELOW8(x)|_POW2_BELOW8((x)>>8))
 470#define _POW2_BELOW32(x) (_POW2_BELOW16(x)|_POW2_BELOW16((x)>>16))
 471#define _POW2_BELOW64(x) (_POW2_BELOW32(x)|_POW2_BELOW32((x)>>32))
 472#define POW2_BELOW32(x) ((_POW2_BELOW32(x)>>1) + 1)
 473#define POW2_BELOW64(x) ((_POW2_BELOW64(x)>>1) + 1)
 474
 475#define CREDITS_PER_JIFFY POW2_BELOW64(MAX_CPJ)
 476#define CREDITS_PER_JIFFY_v1 POW2_BELOW32(MAX_CPJ_v1)
 477
 478/* in byte mode, the lowest possible rate is one packet/second.
 479 * credit_cap is used as a counter that tells us how many times we can
 480 * refill the "credits available" counter when it becomes empty.
 481 */
 482#define MAX_CPJ_BYTES (0xFFFFFFFF / HZ)
 483#define CREDITS_PER_JIFFY_BYTES POW2_BELOW32(MAX_CPJ_BYTES)
 484
 485static u32 xt_hashlimit_len_to_chunks(u32 len)
 486{
 487	return (len >> XT_HASHLIMIT_BYTE_SHIFT) + 1;
 488}
 489
 490/* Precision saver. */
 491static u64 user2credits(u64 user, int revision)
 492{
 493	u64 scale = (revision == 1) ?
 494		XT_HASHLIMIT_SCALE : XT_HASHLIMIT_SCALE_v2;
 495	u64 cpj = (revision == 1) ?
 496		CREDITS_PER_JIFFY_v1 : CREDITS_PER_JIFFY;
 497
 498	/* Avoid overflow: divide the constant operands first */
 499	if (scale >= HZ * cpj)
 500		return div64_u64(user, div64_u64(scale, HZ * cpj));
 501
 502	return user * div64_u64(HZ * cpj, scale);
 503}
 504
 505static u32 user2credits_byte(u32 user)
 506{
 507	u64 us = user;
 508	us *= HZ * CREDITS_PER_JIFFY_BYTES;
 509	return (u32) (us >> 32);
 510}
 511
 512static u64 user2rate(u64 user)
 513{
 514	if (user != 0) {
 515		return div64_u64(XT_HASHLIMIT_SCALE_v2, user);
 516	} else {
 517		pr_info_ratelimited("invalid rate from userspace: %llu\n",
 518				    user);
 519		return 0;
 520	}
 521}
 522
 523static u64 user2rate_bytes(u32 user)
 524{
 525	u64 r;
 526
 527	r = user ? U32_MAX / user : U32_MAX;
 528	return (r - 1) << XT_HASHLIMIT_BYTE_SHIFT;
 529}
 530
 531static void rateinfo_recalc(struct dsthash_ent *dh, unsigned long now,
 532			    u32 mode, int revision)
 533{
 534	unsigned long delta = now - dh->rateinfo.prev;
 535	u64 cap, cpj;
 536
 537	if (delta == 0)
 538		return;
 539
 540	if (revision >= 3 && mode & XT_HASHLIMIT_RATE_MATCH) {
 541		u64 interval = dh->rateinfo.interval * HZ;
 542
 543		if (delta < interval)
 544			return;
 545
 546		dh->rateinfo.prev = now;
 547		dh->rateinfo.prev_window =
 548			((dh->rateinfo.current_rate * interval) >
 549			 (delta * dh->rateinfo.rate));
 550		dh->rateinfo.current_rate = 0;
 551
 552		return;
 553	}
 554
 555	dh->rateinfo.prev = now;
 556
 557	if (mode & XT_HASHLIMIT_BYTES) {
 558		u64 tmp = dh->rateinfo.credit;
 559		dh->rateinfo.credit += CREDITS_PER_JIFFY_BYTES * delta;
 560		cap = CREDITS_PER_JIFFY_BYTES * HZ;
 561		if (tmp >= dh->rateinfo.credit) {/* overflow */
 562			dh->rateinfo.credit = cap;
 563			return;
 564		}
 565	} else {
 566		cpj = (revision == 1) ?
 567			CREDITS_PER_JIFFY_v1 : CREDITS_PER_JIFFY;
 568		dh->rateinfo.credit += delta * cpj;
 569		cap = dh->rateinfo.credit_cap;
 570	}
 571	if (dh->rateinfo.credit > cap)
 572		dh->rateinfo.credit = cap;
 573}
 574
 575static void rateinfo_init(struct dsthash_ent *dh,
 576			  struct xt_hashlimit_htable *hinfo, int revision)
 577{
 578	dh->rateinfo.prev = jiffies;
 579	if (revision >= 3 && hinfo->cfg.mode & XT_HASHLIMIT_RATE_MATCH) {
 580		dh->rateinfo.prev_window = 0;
 581		dh->rateinfo.current_rate = 0;
 582		if (hinfo->cfg.mode & XT_HASHLIMIT_BYTES) {
 583			dh->rateinfo.rate =
 584				user2rate_bytes((u32)hinfo->cfg.avg);
 585			if (hinfo->cfg.burst)
 586				dh->rateinfo.burst =
 587					hinfo->cfg.burst * dh->rateinfo.rate;
 588			else
 589				dh->rateinfo.burst = dh->rateinfo.rate;
 590		} else {
 591			dh->rateinfo.rate = user2rate(hinfo->cfg.avg);
 592			dh->rateinfo.burst =
 593				hinfo->cfg.burst + dh->rateinfo.rate;
 594		}
 595		dh->rateinfo.interval = hinfo->cfg.interval;
 596	} else if (hinfo->cfg.mode & XT_HASHLIMIT_BYTES) {
 597		dh->rateinfo.credit = CREDITS_PER_JIFFY_BYTES * HZ;
 598		dh->rateinfo.cost = user2credits_byte(hinfo->cfg.avg);
 599		dh->rateinfo.credit_cap = hinfo->cfg.burst;
 600	} else {
 601		dh->rateinfo.credit = user2credits(hinfo->cfg.avg *
 602						   hinfo->cfg.burst, revision);
 603		dh->rateinfo.cost = user2credits(hinfo->cfg.avg, revision);
 604		dh->rateinfo.credit_cap = dh->rateinfo.credit;
 605	}
 606}
 607
 608static inline __be32 maskl(__be32 a, unsigned int l)
 609{
 610	return l ? htonl(ntohl(a) & ~0 << (32 - l)) : 0;
 611}
 612
 613#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
 614static void hashlimit_ipv6_mask(__be32 *i, unsigned int p)
 615{
 616	switch (p) {
 617	case 0 ... 31:
 618		i[0] = maskl(i[0], p);
 619		i[1] = i[2] = i[3] = 0;
 620		break;
 621	case 32 ... 63:
 622		i[1] = maskl(i[1], p - 32);
 623		i[2] = i[3] = 0;
 624		break;
 625	case 64 ... 95:
 626		i[2] = maskl(i[2], p - 64);
 627		i[3] = 0;
 628		break;
 629	case 96 ... 127:
 630		i[3] = maskl(i[3], p - 96);
 631		break;
 632	case 128:
 633		break;
 634	}
 635}
 636#endif
 637
 638static int
 639hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
 640		   struct dsthash_dst *dst,
 641		   const struct sk_buff *skb, unsigned int protoff)
 642{
 643	__be16 _ports[2], *ports;
 644	u8 nexthdr;
 645	int poff;
 646
 647	memset(dst, 0, sizeof(*dst));
 648
 649	switch (hinfo->family) {
 650	case NFPROTO_IPV4:
 651		if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_DIP)
 652			dst->ip.dst = maskl(ip_hdr(skb)->daddr,
 653			              hinfo->cfg.dstmask);
 654		if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_SIP)
 655			dst->ip.src = maskl(ip_hdr(skb)->saddr,
 656			              hinfo->cfg.srcmask);
 657
 658		if (!(hinfo->cfg.mode &
 659		      (XT_HASHLIMIT_HASH_DPT | XT_HASHLIMIT_HASH_SPT)))
 660			return 0;
 661		nexthdr = ip_hdr(skb)->protocol;
 662		break;
 663#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
 664	case NFPROTO_IPV6:
 665	{
 666		__be16 frag_off;
 667
 668		if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_DIP) {
 669			memcpy(&dst->ip6.dst, &ipv6_hdr(skb)->daddr,
 670			       sizeof(dst->ip6.dst));
 671			hashlimit_ipv6_mask(dst->ip6.dst, hinfo->cfg.dstmask);
 672		}
 673		if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_SIP) {
 674			memcpy(&dst->ip6.src, &ipv6_hdr(skb)->saddr,
 675			       sizeof(dst->ip6.src));
 676			hashlimit_ipv6_mask(dst->ip6.src, hinfo->cfg.srcmask);
 677		}
 678
 679		if (!(hinfo->cfg.mode &
 680		      (XT_HASHLIMIT_HASH_DPT | XT_HASHLIMIT_HASH_SPT)))
 681			return 0;
 682		nexthdr = ipv6_hdr(skb)->nexthdr;
 683		protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr, &frag_off);
 684		if ((int)protoff < 0)
 685			return -1;
 686		break;
 687	}
 688#endif
 689	default:
 690		BUG();
 691		return 0;
 692	}
 693
 694	poff = proto_ports_offset(nexthdr);
 695	if (poff >= 0) {
 696		ports = skb_header_pointer(skb, protoff + poff, sizeof(_ports),
 697					   &_ports);
 698	} else {
 699		_ports[0] = _ports[1] = 0;
 700		ports = _ports;
 701	}
 702	if (!ports)
 703		return -1;
 704	if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_SPT)
 705		dst->src_port = ports[0];
 706	if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_DPT)
 707		dst->dst_port = ports[1];
 708	return 0;
 709}
 710
 711static u32 hashlimit_byte_cost(unsigned int len, struct dsthash_ent *dh)
 712{
 713	u64 tmp = xt_hashlimit_len_to_chunks(len);
 714	tmp = tmp * dh->rateinfo.cost;
 715
 716	if (unlikely(tmp > CREDITS_PER_JIFFY_BYTES * HZ))
 717		tmp = CREDITS_PER_JIFFY_BYTES * HZ;
 718
 719	if (dh->rateinfo.credit < tmp && dh->rateinfo.credit_cap) {
 720		dh->rateinfo.credit_cap--;
 721		dh->rateinfo.credit = CREDITS_PER_JIFFY_BYTES * HZ;
 722	}
 723	return (u32) tmp;
 724}
 725
 726static bool
 727hashlimit_mt_common(const struct sk_buff *skb, struct xt_action_param *par,
 728		    struct xt_hashlimit_htable *hinfo,
 729		    const struct hashlimit_cfg3 *cfg, int revision)
 730{
 731	unsigned long now = jiffies;
 732	struct dsthash_ent *dh;
 733	struct dsthash_dst dst;
 734	bool race = false;
 735	u64 cost;
 736
 737	if (hashlimit_init_dst(hinfo, &dst, skb, par->thoff) < 0)
 738		goto hotdrop;
 739
 740	local_bh_disable();
 741	dh = dsthash_find(hinfo, &dst);
 742	if (dh == NULL) {
 743		dh = dsthash_alloc_init(hinfo, &dst, &race);
 744		if (dh == NULL) {
 745			local_bh_enable();
 746			goto hotdrop;
 747		} else if (race) {
 748			/* Already got an entry, update expiration timeout */
 749			dh->expires = now + msecs_to_jiffies(hinfo->cfg.expire);
 750			rateinfo_recalc(dh, now, hinfo->cfg.mode, revision);
 751		} else {
 752			dh->expires = jiffies + msecs_to_jiffies(hinfo->cfg.expire);
 753			rateinfo_init(dh, hinfo, revision);
 754		}
 755	} else {
 756		/* update expiration timeout */
 757		dh->expires = now + msecs_to_jiffies(hinfo->cfg.expire);
 758		rateinfo_recalc(dh, now, hinfo->cfg.mode, revision);
 759	}
 760
 761	if (cfg->mode & XT_HASHLIMIT_RATE_MATCH) {
 762		cost = (cfg->mode & XT_HASHLIMIT_BYTES) ? skb->len : 1;
 763		dh->rateinfo.current_rate += cost;
 764
 765		if (!dh->rateinfo.prev_window &&
 766		    (dh->rateinfo.current_rate <= dh->rateinfo.burst)) {
 767			spin_unlock(&dh->lock);
 768			local_bh_enable();
 769			return !(cfg->mode & XT_HASHLIMIT_INVERT);
 770		} else {
 771			goto overlimit;
 772		}
 773	}
 774
 775	if (cfg->mode & XT_HASHLIMIT_BYTES)
 776		cost = hashlimit_byte_cost(skb->len, dh);
 777	else
 778		cost = dh->rateinfo.cost;
 779
 780	if (dh->rateinfo.credit >= cost) {
 781		/* below the limit */
 782		dh->rateinfo.credit -= cost;
 783		spin_unlock(&dh->lock);
 784		local_bh_enable();
 785		return !(cfg->mode & XT_HASHLIMIT_INVERT);
 786	}
 787
 788overlimit:
 789	spin_unlock(&dh->lock);
 790	local_bh_enable();
 791	/* default match is underlimit - so over the limit, we need to invert */
 792	return cfg->mode & XT_HASHLIMIT_INVERT;
 793
 794 hotdrop:
 795	par->hotdrop = true;
 796	return false;
 797}
 798
 799static bool
 800hashlimit_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
 801{
 802	const struct xt_hashlimit_mtinfo1 *info = par->matchinfo;
 803	struct xt_hashlimit_htable *hinfo = info->hinfo;
 804	struct hashlimit_cfg3 cfg = {};
 805	int ret;
 806
 807	ret = cfg_copy(&cfg, (void *)&info->cfg, 1);
 808	if (ret)
 809		return ret;
 810
 811	return hashlimit_mt_common(skb, par, hinfo, &cfg, 1);
 812}
 813
 814static bool
 815hashlimit_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
 816{
 817	const struct xt_hashlimit_mtinfo2 *info = par->matchinfo;
 818	struct xt_hashlimit_htable *hinfo = info->hinfo;
 819	struct hashlimit_cfg3 cfg = {};
 820	int ret;
 821
 822	ret = cfg_copy(&cfg, (void *)&info->cfg, 2);
 823	if (ret)
 824		return ret;
 825
 826	return hashlimit_mt_common(skb, par, hinfo, &cfg, 2);
 827}
 828
 829static bool
 830hashlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
 831{
 832	const struct xt_hashlimit_mtinfo3 *info = par->matchinfo;
 833	struct xt_hashlimit_htable *hinfo = info->hinfo;
 834
 835	return hashlimit_mt_common(skb, par, hinfo, &info->cfg, 3);
 836}
 837
 838#define HASHLIMIT_MAX_SIZE 1048576
 839
 840static int hashlimit_mt_check_common(const struct xt_mtchk_param *par,
 841				     struct xt_hashlimit_htable **hinfo,
 842				     struct hashlimit_cfg3 *cfg,
 843				     const char *name, int revision)
 844{
 845	struct net *net = par->net;
 846	int ret;
 847
 848	if (cfg->gc_interval == 0 || cfg->expire == 0)
 849		return -EINVAL;
 850	if (cfg->size > HASHLIMIT_MAX_SIZE) {
 851		cfg->size = HASHLIMIT_MAX_SIZE;
 852		pr_info_ratelimited("size too large, truncated to %u\n", cfg->size);
 853	}
 854	if (cfg->max > HASHLIMIT_MAX_SIZE) {
 855		cfg->max = HASHLIMIT_MAX_SIZE;
 856		pr_info_ratelimited("max too large, truncated to %u\n", cfg->max);
 857	}
 858	if (par->family == NFPROTO_IPV4) {
 859		if (cfg->srcmask > 32 || cfg->dstmask > 32)
 860			return -EINVAL;
 861	} else {
 862		if (cfg->srcmask > 128 || cfg->dstmask > 128)
 863			return -EINVAL;
 864	}
 865
 866	if (cfg->mode & ~XT_HASHLIMIT_ALL) {
 867		pr_info_ratelimited("Unknown mode mask %X, kernel too old?\n",
 868				    cfg->mode);
 869		return -EINVAL;
 870	}
 871
 872	/* Check for overflow. */
 873	if (revision >= 3 && cfg->mode & XT_HASHLIMIT_RATE_MATCH) {
 874		if (cfg->avg == 0 || cfg->avg > U32_MAX) {
 875			pr_info_ratelimited("invalid rate\n");
 876			return -ERANGE;
 877		}
 878
 879		if (cfg->interval == 0) {
 880			pr_info_ratelimited("invalid interval\n");
 881			return -EINVAL;
 882		}
 883	} else if (cfg->mode & XT_HASHLIMIT_BYTES) {
 884		if (user2credits_byte(cfg->avg) == 0) {
 885			pr_info_ratelimited("overflow, rate too high: %llu\n",
 886					    cfg->avg);
 887			return -EINVAL;
 888		}
 889	} else if (cfg->burst == 0 ||
 890		   user2credits(cfg->avg * cfg->burst, revision) <
 891		   user2credits(cfg->avg, revision)) {
 892		pr_info_ratelimited("overflow, try lower: %llu/%llu\n",
 893				    cfg->avg, cfg->burst);
 894		return -ERANGE;
 895	}
 896
 897	mutex_lock(&hashlimit_mutex);
 898	*hinfo = htable_find_get(net, name, par->family);
 899	if (*hinfo == NULL) {
 900		ret = htable_create(net, cfg, name, par->family,
 901				    hinfo, revision);
 902		if (ret < 0) {
 903			mutex_unlock(&hashlimit_mutex);
 904			return ret;
 905		}
 906	}
 907	mutex_unlock(&hashlimit_mutex);
 908
 909	return 0;
 910}
 911
 912static int hashlimit_mt_check_v1(const struct xt_mtchk_param *par)
 913{
 914	struct xt_hashlimit_mtinfo1 *info = par->matchinfo;
 915	struct hashlimit_cfg3 cfg = {};
 916	int ret;
 917
 918	ret = xt_check_proc_name(info->name, sizeof(info->name));
 919	if (ret)
 920		return ret;
 921
 922	ret = cfg_copy(&cfg, (void *)&info->cfg, 1);
 923	if (ret)
 924		return ret;
 925
 926	return hashlimit_mt_check_common(par, &info->hinfo,
 927					 &cfg, info->name, 1);
 928}
 929
 930static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par)
 931{
 932	struct xt_hashlimit_mtinfo2 *info = par->matchinfo;
 933	struct hashlimit_cfg3 cfg = {};
 934	int ret;
 935
 936	ret = xt_check_proc_name(info->name, sizeof(info->name));
 937	if (ret)
 938		return ret;
 939
 940	ret = cfg_copy(&cfg, (void *)&info->cfg, 2);
 941	if (ret)
 942		return ret;
 943
 944	return hashlimit_mt_check_common(par, &info->hinfo,
 945					 &cfg, info->name, 2);
 946}
 947
 948static int hashlimit_mt_check(const struct xt_mtchk_param *par)
 949{
 950	struct xt_hashlimit_mtinfo3 *info = par->matchinfo;
 951	int ret;
 952
 953	ret = xt_check_proc_name(info->name, sizeof(info->name));
 954	if (ret)
 955		return ret;
 956
 957	return hashlimit_mt_check_common(par, &info->hinfo, &info->cfg,
 958					 info->name, 3);
 959}
 960
 961static void hashlimit_mt_destroy_v2(const struct xt_mtdtor_param *par)
 962{
 963	const struct xt_hashlimit_mtinfo2 *info = par->matchinfo;
 964
 965	htable_put(info->hinfo);
 966}
 967
 968static void hashlimit_mt_destroy_v1(const struct xt_mtdtor_param *par)
 969{
 970	const struct xt_hashlimit_mtinfo1 *info = par->matchinfo;
 971
 972	htable_put(info->hinfo);
 973}
 974
 975static void hashlimit_mt_destroy(const struct xt_mtdtor_param *par)
 976{
 977	const struct xt_hashlimit_mtinfo3 *info = par->matchinfo;
 978
 979	htable_put(info->hinfo);
 980}
 981
 982static struct xt_match hashlimit_mt_reg[] __read_mostly = {
 983	{
 984		.name           = "hashlimit",
 985		.revision       = 1,
 986		.family         = NFPROTO_IPV4,
 987		.match          = hashlimit_mt_v1,
 988		.matchsize      = sizeof(struct xt_hashlimit_mtinfo1),
 989		.usersize	= offsetof(struct xt_hashlimit_mtinfo1, hinfo),
 990		.checkentry     = hashlimit_mt_check_v1,
 991		.destroy        = hashlimit_mt_destroy_v1,
 992		.me             = THIS_MODULE,
 993	},
 994	{
 995		.name           = "hashlimit",
 996		.revision       = 2,
 997		.family         = NFPROTO_IPV4,
 998		.match          = hashlimit_mt_v2,
 999		.matchsize      = sizeof(struct xt_hashlimit_mtinfo2),
1000		.usersize	= offsetof(struct xt_hashlimit_mtinfo2, hinfo),
1001		.checkentry     = hashlimit_mt_check_v2,
1002		.destroy        = hashlimit_mt_destroy_v2,
1003		.me             = THIS_MODULE,
1004	},
1005	{
1006		.name           = "hashlimit",
1007		.revision       = 3,
1008		.family         = NFPROTO_IPV4,
1009		.match          = hashlimit_mt,
1010		.matchsize      = sizeof(struct xt_hashlimit_mtinfo3),
1011		.usersize	= offsetof(struct xt_hashlimit_mtinfo3, hinfo),
1012		.checkentry     = hashlimit_mt_check,
1013		.destroy        = hashlimit_mt_destroy,
1014		.me             = THIS_MODULE,
1015	},
1016#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
1017	{
1018		.name           = "hashlimit",
1019		.revision       = 1,
1020		.family         = NFPROTO_IPV6,
1021		.match          = hashlimit_mt_v1,
1022		.matchsize      = sizeof(struct xt_hashlimit_mtinfo1),
1023		.usersize	= offsetof(struct xt_hashlimit_mtinfo1, hinfo),
1024		.checkentry     = hashlimit_mt_check_v1,
1025		.destroy        = hashlimit_mt_destroy_v1,
1026		.me             = THIS_MODULE,
1027	},
1028	{
1029		.name           = "hashlimit",
1030		.revision       = 2,
1031		.family         = NFPROTO_IPV6,
1032		.match          = hashlimit_mt_v2,
1033		.matchsize      = sizeof(struct xt_hashlimit_mtinfo2),
1034		.usersize	= offsetof(struct xt_hashlimit_mtinfo2, hinfo),
1035		.checkentry     = hashlimit_mt_check_v2,
1036		.destroy        = hashlimit_mt_destroy_v2,
1037		.me             = THIS_MODULE,
1038	},
1039	{
1040		.name           = "hashlimit",
1041		.revision       = 3,
1042		.family         = NFPROTO_IPV6,
1043		.match          = hashlimit_mt,
1044		.matchsize      = sizeof(struct xt_hashlimit_mtinfo3),
1045		.usersize	= offsetof(struct xt_hashlimit_mtinfo3, hinfo),
1046		.checkentry     = hashlimit_mt_check,
1047		.destroy        = hashlimit_mt_destroy,
1048		.me             = THIS_MODULE,
1049	},
1050#endif
1051};
1052
1053/* PROC stuff */
1054static void *dl_seq_start(struct seq_file *s, loff_t *pos)
1055	__acquires(htable->lock)
1056{
1057	struct xt_hashlimit_htable *htable = pde_data(file_inode(s->file));
1058	unsigned int *bucket;
1059
1060	spin_lock_bh(&htable->lock);
1061	if (*pos >= htable->cfg.size)
1062		return NULL;
1063
1064	bucket = kmalloc(sizeof(unsigned int), GFP_ATOMIC);
1065	if (!bucket)
1066		return ERR_PTR(-ENOMEM);
1067
1068	*bucket = *pos;
1069	return bucket;
1070}
1071
1072static void *dl_seq_next(struct seq_file *s, void *v, loff_t *pos)
1073{
1074	struct xt_hashlimit_htable *htable = pde_data(file_inode(s->file));
1075	unsigned int *bucket = v;
1076
1077	*pos = ++(*bucket);
1078	if (*pos >= htable->cfg.size) {
1079		kfree(v);
1080		return NULL;
1081	}
1082	return bucket;
1083}
1084
1085static void dl_seq_stop(struct seq_file *s, void *v)
1086	__releases(htable->lock)
1087{
1088	struct xt_hashlimit_htable *htable = pde_data(file_inode(s->file));
1089	unsigned int *bucket = v;
1090
1091	if (!IS_ERR(bucket))
1092		kfree(bucket);
1093	spin_unlock_bh(&htable->lock);
1094}
1095
1096static void dl_seq_print(struct dsthash_ent *ent, u_int8_t family,
1097			 struct seq_file *s)
1098{
1099	switch (family) {
1100	case NFPROTO_IPV4:
1101		seq_printf(s, "%ld %pI4:%u->%pI4:%u %llu %llu %llu\n",
1102			   (long)(ent->expires - jiffies)/HZ,
1103			   &ent->dst.ip.src,
1104			   ntohs(ent->dst.src_port),
1105			   &ent->dst.ip.dst,
1106			   ntohs(ent->dst.dst_port),
1107			   ent->rateinfo.credit, ent->rateinfo.credit_cap,
1108			   ent->rateinfo.cost);
1109		break;
1110#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
1111	case NFPROTO_IPV6:
1112		seq_printf(s, "%ld %pI6:%u->%pI6:%u %llu %llu %llu\n",
1113			   (long)(ent->expires - jiffies)/HZ,
1114			   &ent->dst.ip6.src,
1115			   ntohs(ent->dst.src_port),
1116			   &ent->dst.ip6.dst,
1117			   ntohs(ent->dst.dst_port),
1118			   ent->rateinfo.credit, ent->rateinfo.credit_cap,
1119			   ent->rateinfo.cost);
1120		break;
1121#endif
1122	default:
1123		BUG();
1124	}
1125}
1126
1127static int dl_seq_real_show_v2(struct dsthash_ent *ent, u_int8_t family,
1128			       struct seq_file *s)
1129{
1130	struct xt_hashlimit_htable *ht = pde_data(file_inode(s->file));
1131
1132	spin_lock(&ent->lock);
1133	/* recalculate to show accurate numbers */
1134	rateinfo_recalc(ent, jiffies, ht->cfg.mode, 2);
1135
1136	dl_seq_print(ent, family, s);
1137
1138	spin_unlock(&ent->lock);
1139	return seq_has_overflowed(s);
1140}
1141
1142static int dl_seq_real_show_v1(struct dsthash_ent *ent, u_int8_t family,
1143			       struct seq_file *s)
1144{
1145	struct xt_hashlimit_htable *ht = pde_data(file_inode(s->file));
1146
1147	spin_lock(&ent->lock);
1148	/* recalculate to show accurate numbers */
1149	rateinfo_recalc(ent, jiffies, ht->cfg.mode, 1);
1150
1151	dl_seq_print(ent, family, s);
1152
1153	spin_unlock(&ent->lock);
1154	return seq_has_overflowed(s);
1155}
1156
1157static int dl_seq_real_show(struct dsthash_ent *ent, u_int8_t family,
1158			    struct seq_file *s)
1159{
1160	struct xt_hashlimit_htable *ht = pde_data(file_inode(s->file));
1161
1162	spin_lock(&ent->lock);
1163	/* recalculate to show accurate numbers */
1164	rateinfo_recalc(ent, jiffies, ht->cfg.mode, 3);
1165
1166	dl_seq_print(ent, family, s);
1167
1168	spin_unlock(&ent->lock);
1169	return seq_has_overflowed(s);
1170}
1171
1172static int dl_seq_show_v2(struct seq_file *s, void *v)
1173{
1174	struct xt_hashlimit_htable *htable = pde_data(file_inode(s->file));
1175	unsigned int *bucket = (unsigned int *)v;
1176	struct dsthash_ent *ent;
1177
1178	if (!hlist_empty(&htable->hash[*bucket])) {
1179		hlist_for_each_entry(ent, &htable->hash[*bucket], node)
1180			if (dl_seq_real_show_v2(ent, htable->family, s))
1181				return -1;
1182	}
1183	return 0;
1184}
1185
1186static int dl_seq_show_v1(struct seq_file *s, void *v)
1187{
1188	struct xt_hashlimit_htable *htable = pde_data(file_inode(s->file));
1189	unsigned int *bucket = v;
1190	struct dsthash_ent *ent;
1191
1192	if (!hlist_empty(&htable->hash[*bucket])) {
1193		hlist_for_each_entry(ent, &htable->hash[*bucket], node)
1194			if (dl_seq_real_show_v1(ent, htable->family, s))
1195				return -1;
1196	}
1197	return 0;
1198}
1199
1200static int dl_seq_show(struct seq_file *s, void *v)
1201{
1202	struct xt_hashlimit_htable *htable = pde_data(file_inode(s->file));
1203	unsigned int *bucket = v;
1204	struct dsthash_ent *ent;
1205
1206	if (!hlist_empty(&htable->hash[*bucket])) {
1207		hlist_for_each_entry(ent, &htable->hash[*bucket], node)
1208			if (dl_seq_real_show(ent, htable->family, s))
1209				return -1;
1210	}
1211	return 0;
1212}
1213
1214static const struct seq_operations dl_seq_ops_v1 = {
1215	.start = dl_seq_start,
1216	.next  = dl_seq_next,
1217	.stop  = dl_seq_stop,
1218	.show  = dl_seq_show_v1
1219};
1220
1221static const struct seq_operations dl_seq_ops_v2 = {
1222	.start = dl_seq_start,
1223	.next  = dl_seq_next,
1224	.stop  = dl_seq_stop,
1225	.show  = dl_seq_show_v2
1226};
1227
1228static const struct seq_operations dl_seq_ops = {
1229	.start = dl_seq_start,
1230	.next  = dl_seq_next,
1231	.stop  = dl_seq_stop,
1232	.show  = dl_seq_show
1233};
1234
1235static int __net_init hashlimit_proc_net_init(struct net *net)
1236{
1237	struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
1238
1239	hashlimit_net->ipt_hashlimit = proc_mkdir("ipt_hashlimit", net->proc_net);
1240	if (!hashlimit_net->ipt_hashlimit)
1241		return -ENOMEM;
1242#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
1243	hashlimit_net->ip6t_hashlimit = proc_mkdir("ip6t_hashlimit", net->proc_net);
1244	if (!hashlimit_net->ip6t_hashlimit) {
1245		remove_proc_entry("ipt_hashlimit", net->proc_net);
1246		return -ENOMEM;
1247	}
1248#endif
1249	return 0;
1250}
1251
1252static void __net_exit hashlimit_proc_net_exit(struct net *net)
1253{
1254	struct xt_hashlimit_htable *hinfo;
1255	struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
1256
1257	/* hashlimit_net_exit() is called before hashlimit_mt_destroy().
1258	 * Make sure that the parent ipt_hashlimit and ip6t_hashlimit proc
1259	 * entries is empty before trying to remove it.
1260	 */
1261	mutex_lock(&hashlimit_mutex);
1262	hlist_for_each_entry(hinfo, &hashlimit_net->htables, node)
1263		htable_remove_proc_entry(hinfo);
1264	hashlimit_net->ipt_hashlimit = NULL;
1265	hashlimit_net->ip6t_hashlimit = NULL;
1266	mutex_unlock(&hashlimit_mutex);
1267
1268	remove_proc_entry("ipt_hashlimit", net->proc_net);
1269#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
1270	remove_proc_entry("ip6t_hashlimit", net->proc_net);
1271#endif
1272}
1273
1274static int __net_init hashlimit_net_init(struct net *net)
1275{
1276	struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
1277
1278	INIT_HLIST_HEAD(&hashlimit_net->htables);
1279	return hashlimit_proc_net_init(net);
1280}
1281
1282static void __net_exit hashlimit_net_exit(struct net *net)
1283{
1284	hashlimit_proc_net_exit(net);
1285}
1286
1287static struct pernet_operations hashlimit_net_ops = {
1288	.init	= hashlimit_net_init,
1289	.exit	= hashlimit_net_exit,
1290	.id	= &hashlimit_net_id,
1291	.size	= sizeof(struct hashlimit_net),
1292};
1293
1294static int __init hashlimit_mt_init(void)
1295{
1296	int err;
1297
1298	err = register_pernet_subsys(&hashlimit_net_ops);
1299	if (err < 0)
1300		return err;
1301	err = xt_register_matches(hashlimit_mt_reg,
1302	      ARRAY_SIZE(hashlimit_mt_reg));
1303	if (err < 0)
1304		goto err1;
1305
1306	err = -ENOMEM;
1307	hashlimit_cachep = kmem_cache_create("xt_hashlimit",
1308					    sizeof(struct dsthash_ent), 0, 0,
1309					    NULL);
1310	if (!hashlimit_cachep) {
1311		pr_warn("unable to create slab cache\n");
1312		goto err2;
1313	}
1314	return 0;
1315
1316err2:
1317	xt_unregister_matches(hashlimit_mt_reg, ARRAY_SIZE(hashlimit_mt_reg));
1318err1:
1319	unregister_pernet_subsys(&hashlimit_net_ops);
1320	return err;
1321
1322}
1323
1324static void __exit hashlimit_mt_exit(void)
1325{
1326	xt_unregister_matches(hashlimit_mt_reg, ARRAY_SIZE(hashlimit_mt_reg));
1327	unregister_pernet_subsys(&hashlimit_net_ops);
1328
1329	rcu_barrier();
1330	kmem_cache_destroy(hashlimit_cachep);
1331}
1332
1333module_init(hashlimit_mt_init);
1334module_exit(hashlimit_mt_exit);