[deliverable/linux.git] / net / netfilter / xt_connbytes.c

/* Kernel module to match connection tracking byte counter.
 * GPL (C) 2002 Martin Devera (devik@cdi.cz).
 */
#include <linux/module.h>
#include <linux/bitops.h>
#include <linux/skbuff.h>
#include <linux/math64.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_connbytes.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_acct.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("Xtables: Number of packets/bytes per connection matching");
MODULE_ALIAS("ipt_connbytes");
MODULE_ALIAS("ip6t_connbytes");

static bool
connbytes_mt(const struct sk_buff *skb, const struct xt_match_param *par)
{
	const struct xt_connbytes_info *sinfo = par->matchinfo;
	const struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
	u_int64_t what = 0;	/* initialize to make gcc happy */
	u_int64_t bytes = 0;
	u_int64_t pkts = 0;
	const struct nf_conn_counter *counters;

	ct = nf_ct_get(skb, &ctinfo);
	if (!ct)
		return false;

	counters = nf_conn_acct_find(ct);
	if (!counters)
		return false;

	switch (sinfo->what) {
	case XT_CONNBYTES_PKTS:
		switch (sinfo->direction) {
		case XT_CONNBYTES_DIR_ORIGINAL:
			what = counters[IP_CT_DIR_ORIGINAL].packets;
			break;
		case XT_CONNBYTES_DIR_REPLY:
			what = counters[IP_CT_DIR_REPLY].packets;
			break;
		case XT_CONNBYTES_DIR_BOTH:
			what = counters[IP_CT_DIR_ORIGINAL].packets;
			what += counters[IP_CT_DIR_REPLY].packets;
			break;
		}
		break;
	case XT_CONNBYTES_BYTES:
		switch (sinfo->direction) {
		case XT_CONNBYTES_DIR_ORIGINAL:
			what = counters[IP_CT_DIR_ORIGINAL].bytes;
			break;
		case XT_CONNBYTES_DIR_REPLY:
			what = counters[IP_CT_DIR_REPLY].bytes;
			break;
		case XT_CONNBYTES_DIR_BOTH:
			what = counters[IP_CT_DIR_ORIGINAL].bytes;
			what += counters[IP_CT_DIR_REPLY].bytes;
			break;
		}
		break;
	case XT_CONNBYTES_AVGPKT:
		switch (sinfo->direction) {
		case XT_CONNBYTES_DIR_ORIGINAL:
			bytes = counters[IP_CT_DIR_ORIGINAL].bytes;
			pkts  = counters[IP_CT_DIR_ORIGINAL].packets;
			break;
		case XT_CONNBYTES_DIR_REPLY:
			bytes = counters[IP_CT_DIR_REPLY].bytes;
			pkts  = counters[IP_CT_DIR_REPLY].packets;
			break;
		case XT_CONNBYTES_DIR_BOTH:
			bytes = counters[IP_CT_DIR_ORIGINAL].bytes +
				counters[IP_CT_DIR_REPLY].bytes;
			pkts  = counters[IP_CT_DIR_ORIGINAL].packets +
				counters[IP_CT_DIR_REPLY].packets;
			break;
		}
		if (pkts != 0)
			what = div64_u64(bytes, pkts);
		break;
	}

	if (sinfo->count.to)
		return what <= sinfo->count.to && what >= sinfo->count.from;
	else
		return what >= sinfo->count.from;
}

static bool
connbytes_mt_check(const char *tablename, const void *ip,
                   const struct xt_match *match, void *matchinfo,
                   unsigned int hook_mask)
{
	const struct xt_connbytes_info *sinfo = matchinfo;

	if (sinfo->what != XT_CONNBYTES_PKTS &&
	    sinfo->what != XT_CONNBYTES_BYTES &&
	    sinfo->what != XT_CONNBYTES_AVGPKT)
		return false;

	if (sinfo->direction != XT_CONNBYTES_DIR_ORIGINAL &&
	    sinfo->direction != XT_CONNBYTES_DIR_REPLY &&
	    sinfo->direction != XT_CONNBYTES_DIR_BOTH)
		return false;

	if (nf_ct_l3proto_try_module_get(match->family) < 0) {
		printk(KERN_WARNING "can't load conntrack support for "
				    "proto=%u\n", match->family);
		return false;
	}

	return true;
}

static void
connbytes_mt_destroy(const struct xt_match *match, void *matchinfo)
{
	nf_ct_l3proto_module_put(match->family);
}

static struct xt_match connbytes_mt_reg[] __read_mostly = {
	{
		.name		= "connbytes",
		.family		= NFPROTO_IPV4,
		.checkentry	= connbytes_mt_check,
		.match		= connbytes_mt,
		.destroy	= connbytes_mt_destroy,
		.matchsize	= sizeof(struct xt_connbytes_info),
		.me		= THIS_MODULE
	},
	{
		.name		= "connbytes",
		.family		= NFPROTO_IPV6,
		.checkentry	= connbytes_mt_check,
		.match		= connbytes_mt,
		.destroy	= connbytes_mt_destroy,
		.matchsize	= sizeof(struct xt_connbytes_info),
		.me		= THIS_MODULE
	},
};

static int __init connbytes_mt_init(void)
{
	return xt_register_matches(connbytes_mt_reg,
	       ARRAY_SIZE(connbytes_mt_reg));
}

static void __exit connbytes_mt_exit(void)
{
	xt_unregister_matches(connbytes_mt_reg, ARRAY_SIZE(connbytes_mt_reg));
}

module_init(connbytes_mt_init);
module_exit(connbytes_mt_exit);
Commit	Line	Data
	1	/* Kernel module to match connection tracking byte counter.
	2	* GPL (C) 2002 Martin Devera (devik@cdi.cz).
	3	*/
	4	#include <linux/module.h>
	5	#include <linux/bitops.h>
	6	#include <linux/skbuff.h>
	7	#include <linux/math64.h>
	8	#include <linux/netfilter/x_tables.h>
	9	#include <linux/netfilter/xt_connbytes.h>
	10	#include <net/netfilter/nf_conntrack.h>
	11	#include <net/netfilter/nf_conntrack_acct.h>
	12
	13	MODULE_LICENSE("GPL");
	14	MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
	15	MODULE_DESCRIPTION("Xtables: Number of packets/bytes per connection matching");
	16	MODULE_ALIAS("ipt_connbytes");
	17	MODULE_ALIAS("ip6t_connbytes");
	18
	19	static bool
	20	connbytes_mt(const struct sk_buff skb, const struct xt_match_param par)
	21	{
	22	const struct xt_connbytes_info *sinfo = par->matchinfo;
	23	const struct nf_conn *ct;
	24	enum ip_conntrack_info ctinfo;
	25	u_int64_t what = 0; /* initialize to make gcc happy */
	26	u_int64_t bytes = 0;
	27	u_int64_t pkts = 0;
	28	const struct nf_conn_counter *counters;
	29
	30	ct = nf_ct_get(skb, &ctinfo);
	31	if (!ct)
	32	return false;
	33
	34	counters = nf_conn_acct_find(ct);
	35	if (!counters)
	36	return false;
	37
	38	switch (sinfo->what) {
	39	case XT_CONNBYTES_PKTS:
	40	switch (sinfo->direction) {
	41	case XT_CONNBYTES_DIR_ORIGINAL:
	42	what = counters[IP_CT_DIR_ORIGINAL].packets;
	43	break;
	44	case XT_CONNBYTES_DIR_REPLY:
	45	what = counters[IP_CT_DIR_REPLY].packets;
	46	break;
	47	case XT_CONNBYTES_DIR_BOTH:
	48	what = counters[IP_CT_DIR_ORIGINAL].packets;
	49	what += counters[IP_CT_DIR_REPLY].packets;
	50	break;
	51	}
	52	break;
	53	case XT_CONNBYTES_BYTES:
	54	switch (sinfo->direction) {
	55	case XT_CONNBYTES_DIR_ORIGINAL:
	56	what = counters[IP_CT_DIR_ORIGINAL].bytes;
	57	break;
	58	case XT_CONNBYTES_DIR_REPLY:
	59	what = counters[IP_CT_DIR_REPLY].bytes;
	60	break;
	61	case XT_CONNBYTES_DIR_BOTH:
	62	what = counters[IP_CT_DIR_ORIGINAL].bytes;
	63	what += counters[IP_CT_DIR_REPLY].bytes;
	64	break;
	65	}
	66	break;
	67	case XT_CONNBYTES_AVGPKT:
	68	switch (sinfo->direction) {
	69	case XT_CONNBYTES_DIR_ORIGINAL:
	70	bytes = counters[IP_CT_DIR_ORIGINAL].bytes;
	71	pkts = counters[IP_CT_DIR_ORIGINAL].packets;
	72	break;
	73	case XT_CONNBYTES_DIR_REPLY:
	74	bytes = counters[IP_CT_DIR_REPLY].bytes;
	75	pkts = counters[IP_CT_DIR_REPLY].packets;
	76	break;
	77	case XT_CONNBYTES_DIR_BOTH:
	78	bytes = counters[IP_CT_DIR_ORIGINAL].bytes +
	79	counters[IP_CT_DIR_REPLY].bytes;
	80	pkts = counters[IP_CT_DIR_ORIGINAL].packets +
	81	counters[IP_CT_DIR_REPLY].packets;
	82	break;
	83	}
	84	if (pkts != 0)
	85	what = div64_u64(bytes, pkts);
	86	break;
	87	}
	88
	89	if (sinfo->count.to)
	90	return what <= sinfo->count.to && what >= sinfo->count.from;
	91	else
	92	return what >= sinfo->count.from;
	93	}
	94
	95	static bool
	96	connbytes_mt_check(const char tablename, const void ip,
	97	const struct xt_match match, void matchinfo,
	98	unsigned int hook_mask)
	99	{
	100	const struct xt_connbytes_info *sinfo = matchinfo;
	101
	102	if (sinfo->what != XT_CONNBYTES_PKTS &&
	103	sinfo->what != XT_CONNBYTES_BYTES &&
	104	sinfo->what != XT_CONNBYTES_AVGPKT)
	105	return false;
	106
	107	if (sinfo->direction != XT_CONNBYTES_DIR_ORIGINAL &&
	108	sinfo->direction != XT_CONNBYTES_DIR_REPLY &&
	109	sinfo->direction != XT_CONNBYTES_DIR_BOTH)
	110	return false;
	111
	112	if (nf_ct_l3proto_try_module_get(match->family) < 0) {
	113	printk(KERN_WARNING "can't load conntrack support for "
	114	"proto=%u\n", match->family);
	115	return false;
	116	}
	117
	118	return true;
	119	}
	120
	121	static void
	122	connbytes_mt_destroy(const struct xt_match match, void matchinfo)
	123	{
	124	nf_ct_l3proto_module_put(match->family);
	125	}
	126
	127	static struct xt_match connbytes_mt_reg[] __read_mostly = {
	128	{
	129	.name = "connbytes",
	130	.family = NFPROTO_IPV4,
	131	.checkentry = connbytes_mt_check,
	132	.match = connbytes_mt,
	133	.destroy = connbytes_mt_destroy,
	134	.matchsize = sizeof(struct xt_connbytes_info),
	135	.me = THIS_MODULE
	136	},
	137	{
	138	.name = "connbytes",
	139	.family = NFPROTO_IPV6,
	140	.checkentry = connbytes_mt_check,
	141	.match = connbytes_mt,
	142	.destroy = connbytes_mt_destroy,
	143	.matchsize = sizeof(struct xt_connbytes_info),
	144	.me = THIS_MODULE
	145	},
	146	};
	147
	148	static int __init connbytes_mt_init(void)
	149	{
	150	return xt_register_matches(connbytes_mt_reg,
	151	ARRAY_SIZE(connbytes_mt_reg));
	152	}
	153
	154	static void __exit connbytes_mt_exit(void)
	155	{
	156	xt_unregister_matches(connbytes_mt_reg, ARRAY_SIZE(connbytes_mt_reg));
	157	}
	158
	159	module_init(connbytes_mt_init);
	160	module_exit(connbytes_mt_exit);