simple iptables based packet limiter to deflect DoS attacks on our clients

[svn/Prometheus-QoS/.git] / prometheus.c

diff --git a/prometheus.c b/prometheus.c
index 3dfcc1a7ed8da2d7222cd64a1ef3d8a025a669dd..c88857b6268e57d9767d419573c0afb15f8c501b 100644 (file)
--- a/prometheus.c
+++ b/prometheus.c
@@ -7,7 +7,7 @@
 /* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf  */\r
 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
 \r
 /* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf  */\r
 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
 \r

-/* Modified by: xChaos, 20131029\r
+/* Modified by: xChaos, 20131118\r

                  ludva, 20080415\r
  \r
    Prometheus QoS is free software; you can redistribute it and/or\r
                  ludva, 20080415\r
  \r
    Prometheus QoS is free software; you can redistribute it and/or\r


@@ -29,7 +29,7 @@
 #include "cll1-0.6.2.h"\r
 #include "ipstruct.h"\r
 \r
 #include "cll1-0.6.2.h"\r
 #include "ipstruct.h"\r
 \r

-const char *version = "0.8.3-i";\r
+const char *version = "0.8.3-j";\r

 \r
 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
 /* Versions: 0.8.3 is development release, 0.8.4 will be "stable"  */\r
 \r
 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */\r
 /* Versions: 0.8.3 is development release, 0.8.4 will be "stable"  */\r


@@ -118,10 +118,6 @@ int     magic_treshold = 8; /* reduce ceil by X*magic_treshhold kbps (hard shapi
 int       keywordcount = 0;\r
 int        class_count = 0;\r
 int           ip_count = 0;\r
 int       keywordcount = 0;\r
 int        class_count = 0;\r
 int           ip_count = 0;\r

-/* not yet implemented:\r
-int      fixed_packets = 0; maximum number of pps per IP address (not class!) \r
-int       packet_limit = 5; maximum number of pps to htn CEIL, not rate !!! \r
-*/\r

 FILE         *log_file = NULL;\r
 char              *kwd = "via-prometheus"; /* /etc/hosts comment, eg. #qos-64-128 */\r
 \r
 FILE         *log_file = NULL;\r
 char              *kwd = "via-prometheus"; /* /etc/hosts comment, eg. #qos-64-128 */\r
 \r


@@ -469,7 +465,7 @@ program
  int i=0;                    /* just plain old Fortran style integer :-) */\r
  FILE *f=NULL;               /* everything is just stream of bytes... */\r
  char *str, *ptr, *d;        /* LET A$=B$ :-) */\r
  int i=0;                    /* just plain old Fortran style integer :-) */\r
  FILE *f=NULL;               /* everything is just stream of bytes... */\r
  char *str, *ptr, *d;        /* LET A$=B$ :-) */\r

- char *substring;\r
+ char *substring, *limit_pkts;\r

 \r
  int parent        = 1;\r
  int just_networks = FALSE;  \r
 \r
  int parent        = 1;\r
  int just_networks = FALSE;  \r


@@ -563,7 +559,8 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
  /*-----------------------------------------------------------------*/\r
  /* cll1.h - let's allocate brand new character buffer...           */\r
  /*-----------------------------------------------------------------*/\r
  /*-----------------------------------------------------------------*/\r
  /* cll1.h - let's allocate brand new character buffer...           */\r
  /*-----------------------------------------------------------------*/\r

- string(str,STRLEN); \r
+ string(str, STRLEN); \r
+ string(limit_pkts, STRLEN);\r

 \r
  /*-----------------------------------------------------------------*/\r
  printf("Parsing class defintion file %s ...\n", hosts);\r
 \r
  /*-----------------------------------------------------------------*/\r
  printf("Parsing class defintion file %s ...\n", hosts);\r


@@ -586,6 +583,7 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
    ip->traffic = 0;\r
    ip->mark = sharedip->mark; \r
    ip->lmsid = sharedip->lmsid;\r
    ip->traffic = 0;\r
    ip->mark = sharedip->mark; \r
    ip->lmsid = sharedip->lmsid;\r

+   ip->pps_limit = sharedip->pps_limit; /* no other way to do this */\r

    break;\r
   }\r
   if(not sharedip)\r
    break;\r
   }\r
   if(not sharedip)\r


@@ -1136,19 +1134,24 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
   /* -------------------------------------------------------- mark download */\r
   \r
   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",\r
   /* -------------------------------------------------------- mark download */\r
   \r
   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",\r

-               chain_postrouting, ip->addr, 32*(1+ip->v6), lan, mark_iptables, ip->mark);\r
+               chain_postrouting, ip->addr, 32*(1+ip->v6),\r
+               lan, mark_iptables, ip->mark);\r

   /* -m limit --limit 1/s */  \r
   iptables_save_line(str, ip->v6);\r
 \r
   if(qos_proxy)\r
   {\r
    sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/%d -o %s -j %s%d",\r
   /* -m limit --limit 1/s */  \r
   iptables_save_line(str, ip->v6);\r
 \r
   if(qos_proxy)\r
   {\r
    sprintf(str, "-A %s -s %s -p tcp --sport %d -d %s/%d -o %s -j %s%d",\r

-                chain_postrouting, proxy_ip, proxy_port, ip->addr, 32*(1+ip->v6), lan, mark_iptables, ip->mark);\r
+                chain_postrouting, proxy_ip, proxy_port, ip->addr,\r
+                32*(1+ip->v6), lan, mark_iptables, ip->mark);\r

    iptables_save_line(str, ip->v6);\r
   }\r
 \r
    iptables_save_line(str, ip->v6);\r
   }\r
 \r

-  sprintf(str, "-A %s -d %s/%d -o %s -j ACCEPT",\r
-               chain_postrouting, ip->addr, 32*(1+ip->v6), lan);\r
+  /* this will be optional in future - hardcoded for now*/\r
+  sprintf(limit_pkts,"-m limit --limit %d/s ", ip->pps_limit);\r
+\r
+  sprintf(str, "-A %s -d %s/%d -o %s %s-j ACCEPT",\r
+               chain_postrouting, ip->addr, 32*(1+ip->v6), lan, limit_pkts);\r

   iptables_save_line(str, ip->v6);\r
 \r
   /* -------------------------------------------------------- mark upload */\r
   iptables_save_line(str, ip->v6);\r
 \r
   /* -------------------------------------------------------- mark upload */\r


@@ -1156,8 +1159,8 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
                chain_forward, ip->addr, 32*(1+ip->v6), wan, mark_iptables, ip->mark);\r
   iptables_save_line(str, ip->v6);\r
 \r
                chain_forward, ip->addr, 32*(1+ip->v6), wan, mark_iptables, ip->mark);\r
   iptables_save_line(str, ip->v6);\r
 \r

-  sprintf(str, "-A %s -s %s/%d -o %s -j ACCEPT",\r
-               chain_forward, ip->addr, 32*(1+ip->v6), wan);\r
+  sprintf(str, "-A %s -s %s/%d -o %s %s-j ACCEPT",\r
+               chain_forward, ip->addr, 32*(1+ip->v6), wan, limit_pkts);\r

   iptables_save_line(str, ip->v6);\r
 \r
   if(ip->min)\r
   iptables_save_line(str, ip->v6);\r
 \r
   if(ip->min)\r


@@ -1168,7 +1171,7 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 #endif\r
 \r
    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d", \r
 #endif\r
 \r
    sprintf(str, "%s class add dev %s parent 1:%d classid 1:%d htb rate %dkbit ceil %dkbit burst %dk prio %d", \r

-                tc, lan, ip->group, ip->mark,ip->min,ip->max, burst, ip->prio);\r
+                tc, lan, ip->group, ip->mark, ip->min, ip->max, burst, ip->prio);\r

    safe_run(str);\r
 \r
    if(strcmpi(ip->keyword->leaf_discipline, "none"))\r
    safe_run(str);\r
 \r
    if(strcmpi(ip->keyword->leaf_discipline, "none"))\r