Gecko [ ifk.uw.edu.pl ]

Name	Size	Permission
ACCOUNT	[ DIR ]	drwxr-xr-x
pknock	[ DIR ]	drwxr-xr-x
Kbuild	1020 B	-rw-r--r--
Makefile	14.31 KB	-rw-r--r--
Makefile.am	910 B	-rw-r--r--
Makefile.in	13.55 KB	-rw-r--r--
Mbuild	989 B	-rw-r--r--
compat_skbuff.h	325 B	-rw-r--r--
compat_user.h	262 B	-rw-r--r--
compat_xtables.c	1.18 KB	-rw-r--r--
compat_xtables.h	2.52 KB	-rw-r--r--
compat_xtnu.h	1.97 KB	-rw-r--r--
libxt_CHAOS.c	2.56 KB	-rw-r--r--
libxt_CHAOS.man	1 KB	-rw-r--r--
libxt_DELUDE.c	1.11 KB	-rw-r--r--
libxt_DELUDE.man	286 B	-rw-r--r--
libxt_DHCPMAC.c	2.55 KB	-rw-r--r--
libxt_DHCPMAC.man	1.2 KB	-rw-r--r--
libxt_DNETMAP.c	6.62 KB	-rw-r--r--
libxt_DNETMAP.man	7.71 KB	-rw-r--r--
libxt_ECHO.c	1.03 KB	-rw-r--r--
libxt_ECHO.man	141 B	-rw-r--r--
libxt_IPMARK.c	4.71 KB	-rw-r--r--
libxt_IPMARK.man	1.99 KB	-rw-r--r--
libxt_LOGMARK.c	3.27 KB	-rw-r--r--
libxt_LOGMARK.man	312 B	-rw-r--r--
libxt_SYSRQ.c	844 B	-rw-r--r--
libxt_SYSRQ.man	3.67 KB	-rw-r--r--
libxt_TARPIT.c	2.75 KB	-rw-r--r--
libxt_TARPIT.man	2.55 KB	-rw-r--r--
libxt_condition.c	2.5 KB	-rw-r--r--
libxt_condition.man	175 B	-rw-r--r--
libxt_dhcpmac.c	2.52 KB	-rw-r--r--
libxt_dhcpmac.man	207 B	-rw-r--r--
libxt_fuzzy.c	3.37 KB	-rw-r--r--
libxt_fuzzy.man	263 B	-rw-r--r--
libxt_geoip.c	8.21 KB	-rw-r--r--
libxt_geoip.man	1 KB	-rw-r--r--
libxt_gradm.c	2.3 KB	-rw-r--r--
libxt_gradm.man	225 B	-rw-r--r--
libxt_iface.c	7.21 KB	-rw-r--r--
libxt_iface.man	1.39 KB	-rw-r--r--
libxt_ipp2p.c	7.36 KB	-rw-r--r--
libxt_ipp2p.man	1.52 KB	-rw-r--r--
libxt_ipv4options.c	4.32 KB	-rw-r--r--
libxt_ipv4options.man	1.44 KB	-rw-r--r--
libxt_length2.c	4.69 KB	-rw-r--r--
libxt_length2.man	695 B	-rw-r--r--
libxt_lscan.c	2.64 KB	-rw-r--r--
libxt_lscan.man	1.58 KB	-rw-r--r--
libxt_psd.c	5.34 KB	-rw-r--r--
libxt_psd.man	720 B	-rw-r--r--
libxt_quota2.c	4.06 KB	-rw-r--r--
libxt_quota2.man	1.6 KB	-rw-r--r--
mac.c	572 B	-rw-r--r--
xt_CHAOS.c	6.29 KB	-rw-r--r--
xt_CHAOS.h	249 B	-rw-r--r--
xt_DELUDE.c	4.96 KB	-rw-r--r--
xt_DHCPMAC.c	4.18 KB	-rw-r--r--
xt_DHCPMAC.h	311 B	-rw-r--r--
xt_DNETMAP.c	25.22 KB	-rw-r--r--
xt_DNETMAP.h	402 B	-rw-r--r--
xt_ECHO.c	6.98 KB	-rw-r--r--
xt_IPMARK.c	2.75 KB	-rw-r--r--
xt_IPMARK.h	252 B	-rw-r--r--
xt_LOGMARK.c	3.96 KB	-rw-r--r--
xt_LOGMARK.h	209 B	-rw-r--r--
xt_SYSRQ.c	9.75 KB	-rw-r--r--
xt_TARPIT.c	14.94 KB	-rw-r--r--
xt_TARPIT.h	258 B	-rw-r--r--
xt_condition.c	6.75 KB	-rw-r--r--
xt_condition.h	276 B	-rw-r--r--
xt_fuzzy.c	4.65 KB	-rw-r--r--
xt_fuzzy.h	397 B	-rw-r--r--
xt_geoip.c	8.73 KB	-rw-r--r--
xt_geoip.h	1.34 KB	-rw-r--r--
xt_gradm.h	108 B	-rw-r--r--
xt_iface.c	3.32 KB	-rw-r--r--
xt_iface.h	596 B	-rw-r--r--
xt_ipp2p.c	23.63 KB	-rw-r--r--
xt_ipp2p.h	995 B	-rw-r--r--
xt_ipv4options.c	1.96 KB	-rw-r--r--
xt_ipv4options.h	581 B	-rw-r--r--
xt_length2.c	6.99 KB	-rw-r--r--
xt_length2.h	457 B	-rw-r--r--
xt_lscan.c	7.85 KB	-rw-r--r--
xt_lscan.h	200 B	-rw-r--r--
xt_psd.c	14.2 KB	-rw-r--r--
xt_psd.h	792 B	-rw-r--r--
xt_quota2.c	9 KB	-rw-r--r--
xt_quota2.h	478 B	-rw-r--r--

Code Editor : xt_fuzzy.c

/*
 *	This module implements a simple TSK FLC (Takagi-Sugeno-Kang Fuzzy Logic
 *	Controller) that aims to limit, in an adaptive and flexible way, the
 *	packet rate crossing a given stream. It serves as an initial and very
 *	simple (but effective) example of how Fuzzy Logic techniques can be
 *	applied to defeat DoS attacks.
 *
 *	As a matter of fact, Fuzzy Logic can help us to insert any "behavior"
 *	into our code in a precise, adaptive and efficient manner.
 *
 *	The goal is very similar to that of "limit" match, but using techniques
 *	of Fuzzy Control, that allow us to shape the transfer functions
 *	precisely, avoiding over and undershoots - and stuff like that.
 *
 * 2002-08-10  Hime Aguiar e Oliveira Jr. <hime@engineer.com> : Initial version.
 * 2002-08-17  : Changed to eliminate floating point operations .
 * 2002-08-23  : Coding style changes .
 * 2003-04-08  Maciej Soltysiak <solt@dns.toxicilms.tv> : IPv6 Port
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/random.h>
#include <net/tcp.h>
#include <linux/netfilter/x_tables.h>
#include "xt_fuzzy.h"
#include "compat_xtables.h"

/*
 * Packet Acceptance Rate - LOW and Packet Acceptance Rate - HIGH
 * Expressed in percentage.
 */

#define PAR_LOW		1/100
#define PAR_HIGH	1

MODULE_AUTHOR("Hime Aguiar e Oliveira Junior <hime@engineer.com>");
MODULE_DESCRIPTION("Xtables: Fuzzy Logic Controller match");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_fuzzy");
MODULE_ALIAS("ip6t_fuzzy");

static uint8_t mf_high(uint32_t tx, uint32_t mini, uint32_t maxi)
{
	if (tx >= maxi)
		return 100;
	if (tx <= mini)
		return 0;
	return 100 * (tx - mini) / (maxi - mini);
}

static uint8_t mf_low(uint32_t tx, uint32_t mini, uint32_t maxi)
{
	if (tx <= mini)
		return 100;
	if (tx >= maxi)
		return 0;
	return 100 * (maxi - tx) / (maxi - mini);

}

static bool
fuzzy_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
	struct xt_fuzzy_mtinfo *info = (void *)par->matchinfo;
	unsigned long amount;
	uint8_t howhigh, howlow, random_number;

info->bytes_total += skb->len;
	++info->packets_total;
	info->present_time = jiffies;

if (info->present_time >= info->previous_time) {
		amount = info->present_time - info->previous_time;
	} else {
		/*
		 * There was a transition: I choose to re-sample
		 * and keep the old acceptance rate...
	         */
		amount = 0;
		info->previous_time = info->present_time;
		info->bytes_total = info->packets_total = 0;
	}

if (amount > HZ / 10) {
		/* More than 100 ms elapsed ... */

info->mean_rate     = HZ * info->packets_total / amount;
		info->previous_time = info->present_time;
		info->bytes_total   = info->packets_total = 0;

howhigh = mf_high(info->mean_rate, info->minimum_rate,
		          info->maximum_rate);
		howlow  = mf_low(info->mean_rate, info->minimum_rate,
		          info->maximum_rate);

info->acceptance_rate = howhigh * PAR_LOW + PAR_HIGH * howlow;

/*
		 * In fact, the above defuzzification would require a
		 * denominator proportional to (howhigh+howlow) but, in this
		 * particular case, that expression is constant.
		 *
		 * An imediate consequence is that it is not necessary to call
		 * both mf_high and mf_low - but to keep things understandable,
		 * I did so.
		 */
	}

if (info->acceptance_rate < 100) {
		get_random_bytes(&random_number, sizeof(random_number));

if (random_number <= 255 * info->acceptance_rate / 100)
			/*
			 * If within the acceptance, it can pass
			 * => do not match.
			 */
			return false;
		else
			/* It cannot pass (it matches) */
			return true;
	};

/* acceptance_rate == 100 % => Everything passes ... */
	return false;
}

static int fuzzy_mt_check(const struct xt_mtchk_param *par)
{
	const struct xt_fuzzy_mtinfo *info = par->matchinfo;

if (info->minimum_rate < FUZZY_MIN_RATE ||
	    info->maximum_rate > FUZZY_MAX_RATE ||
	    info->minimum_rate >= info->maximum_rate) {
		printk(KERN_INFO KBUILD_MODNAME ": bad values, please check.\n");
		return -EDOM;
	}

return 0;
}

static struct xt_match fuzzy_mt_reg[] __read_mostly = {
	{
		.name       = "fuzzy",
		.revision   = 1,
		.family     = NFPROTO_IPV4,
		.match      = fuzzy_mt,
		.checkentry = fuzzy_mt_check,
		.matchsize  = sizeof(struct xt_fuzzy_mtinfo),
		.me         = THIS_MODULE,
	},
	{
		.name       = "fuzzy",
		.revision   = 1,
		.family     = NFPROTO_IPV6,
		.match      = fuzzy_mt,
		.checkentry = fuzzy_mt_check,
		.matchsize  = sizeof(struct xt_fuzzy_mtinfo),
		.me         = THIS_MODULE,
	},
};

static int __init fuzzy_mt_init(void)
{
	return xt_register_matches(fuzzy_mt_reg, ARRAY_SIZE(fuzzy_mt_reg));
}

static void __exit fuzzy_mt_exit(void)
{
	xt_unregister_matches(fuzzy_mt_reg, ARRAY_SIZE(fuzzy_mt_reg));
}

module_init(fuzzy_mt_init);
module_exit(fuzzy_mt_exit);

${this.title}

Code Editor : xt_fuzzy.c