[net-next-2.6.git] / net / netfilter / xt_connbytes.c

/* Kernel module to match connection tracking byte counter.
 * GPL (C) 2002 Martin Devera (devik@cdi.cz).
 */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/bitops.h>
#include <linux/skbuff.h>
#include <linux/math64.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_connbytes.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_acct.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("Xtables: Number of packets/bytes per connection matching");
MODULE_ALIAS("ipt_connbytes");
MODULE_ALIAS("ip6t_connbytes");

static bool
connbytes_mt(const struct sk_buff *skb, const struct xt_match_param *par)
{
	const struct xt_connbytes_info *sinfo = par->matchinfo;
	const struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
	u_int64_t what = 0;	/* initialize to make gcc happy */
	u_int64_t bytes = 0;
	u_int64_t pkts = 0;
	const struct nf_conn_counter *counters;

	ct = nf_ct_get(skb, &ctinfo);
	if (!ct)
		return false;

	counters = nf_conn_acct_find(ct);
	if (!counters)
		return false;

	switch (sinfo->what) {
	case XT_CONNBYTES_PKTS:
		switch (sinfo->direction) {
		case XT_CONNBYTES_DIR_ORIGINAL:
			what = counters[IP_CT_DIR_ORIGINAL].packets;
			break;
		case XT_CONNBYTES_DIR_REPLY:
			what = counters[IP_CT_DIR_REPLY].packets;
			break;
		case XT_CONNBYTES_DIR_BOTH:
			what = counters[IP_CT_DIR_ORIGINAL].packets;
			what += counters[IP_CT_DIR_REPLY].packets;
			break;
		}
		break;
	case XT_CONNBYTES_BYTES:
		switch (sinfo->direction) {
		case XT_CONNBYTES_DIR_ORIGINAL:
			what = counters[IP_CT_DIR_ORIGINAL].bytes;
			break;
		case XT_CONNBYTES_DIR_REPLY:
			what = counters[IP_CT_DIR_REPLY].bytes;
			break;
		case XT_CONNBYTES_DIR_BOTH:
			what = counters[IP_CT_DIR_ORIGINAL].bytes;
			what += counters[IP_CT_DIR_REPLY].bytes;
			break;
		}
		break;
	case XT_CONNBYTES_AVGPKT:
		switch (sinfo->direction) {
		case XT_CONNBYTES_DIR_ORIGINAL:
			bytes = counters[IP_CT_DIR_ORIGINAL].bytes;
			pkts  = counters[IP_CT_DIR_ORIGINAL].packets;
			break;
		case XT_CONNBYTES_DIR_REPLY:
			bytes = counters[IP_CT_DIR_REPLY].bytes;
			pkts  = counters[IP_CT_DIR_REPLY].packets;
			break;
		case XT_CONNBYTES_DIR_BOTH:
			bytes = counters[IP_CT_DIR_ORIGINAL].bytes +
				counters[IP_CT_DIR_REPLY].bytes;
			pkts  = counters[IP_CT_DIR_ORIGINAL].packets +
				counters[IP_CT_DIR_REPLY].packets;
			break;
		}
		if (pkts != 0)
			what = div64_u64(bytes, pkts);
		break;
	}

	if (sinfo->count.to)
		return what <= sinfo->count.to && what >= sinfo->count.from;
	else
		return what >= sinfo->count.from;
}

static int connbytes_mt_check(const struct xt_mtchk_param *par)
{
	const struct xt_connbytes_info *sinfo = par->matchinfo;
	int ret;

	if (sinfo->what != XT_CONNBYTES_PKTS &&
	    sinfo->what != XT_CONNBYTES_BYTES &&
	    sinfo->what != XT_CONNBYTES_AVGPKT)
		return -EINVAL;

	if (sinfo->direction != XT_CONNBYTES_DIR_ORIGINAL &&
	    sinfo->direction != XT_CONNBYTES_DIR_REPLY &&
	    sinfo->direction != XT_CONNBYTES_DIR_BOTH)
		return -EINVAL;

	ret = nf_ct_l3proto_try_module_get(par->family);
	if (ret < 0)
		pr_info("cannot load conntrack support for proto=%u\n",
			par->family);
	return ret;
}

static void connbytes_mt_destroy(const struct xt_mtdtor_param *par)
{
	nf_ct_l3proto_module_put(par->family);
}

static struct xt_match connbytes_mt_reg __read_mostly = {
	.name       = "connbytes",
	.revision   = 0,
	.family     = NFPROTO_UNSPEC,
	.checkentry = connbytes_mt_check,
	.match      = connbytes_mt,
	.destroy    = connbytes_mt_destroy,
	.matchsize  = sizeof(struct xt_connbytes_info),
	.me         = THIS_MODULE,
};

static int __init connbytes_mt_init(void)
{
	return xt_register_match(&connbytes_mt_reg);
}

static void __exit connbytes_mt_exit(void)
{
	xt_unregister_match(&connbytes_mt_reg);
}

module_init(connbytes_mt_init);
module_exit(connbytes_mt_exit);
Commit	Line	Data
9d810fd2 HW	1	/* Kernel module to match connection tracking byte counter.
9d810fd2 HW	2	* GPL (C) 2002 Martin Devera (devik@cdi.cz).
9d810fd2	3	*/
8bee4bad	4	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9d810fd2	5	#include <linux/module.h>
1977f032	6	#include <linux/bitops.h>
9d810fd2	7	#include <linux/skbuff.h>
6f6d6a1a	8	#include <linux/math64.h>
2e4e6a17 HW	9	#include <linux/netfilter/x_tables.h>
2e4e6a17 HW	10	#include <linux/netfilter/xt_connbytes.h>
587aa641	11	#include <net/netfilter/nf_conntrack.h>
58401572	12	#include <net/netfilter/nf_conntrack_acct.h>
9d810fd2	13
9d810fd2 HW	14	MODULE_LICENSE("GPL");
9d810fd2 HW	15	MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
2ae15b64	16	MODULE_DESCRIPTION("Xtables: Number of packets/bytes per connection matching");
2e4e6a17	17	MODULE_ALIAS("ipt_connbytes");
73aaf935	18	MODULE_ALIAS("ip6t_connbytes");
9d810fd2	19
1d93a9cb	20	static bool
f7108a20	21	connbytes_mt(const struct sk_buff skb, const struct xt_match_param par)
9d810fd2	22	{
f7108a20	23	const struct xt_connbytes_info *sinfo = par->matchinfo;
a47362a2	24	const struct nf_conn *ct;
587aa641	25	enum ip_conntrack_info ctinfo;
9d810fd2	26	u_int64_t what = 0; /* initialize to make gcc happy */
fb74a841 PM	27	u_int64_t bytes = 0;
fb74a841 PM	28	u_int64_t pkts = 0;
58401572	29	const struct nf_conn_counter *counters;
9d810fd2	30
587aa641 PM	31	ct = nf_ct_get(skb, &ctinfo);
587aa641 PM	32	if (!ct)
1d93a9cb	33	return false;
58401572 KPO	34
	35	counters = nf_conn_acct_find(ct);
	36	if (!counters)
	37	return false;
9d810fd2 HW	38
9d810fd2 HW	39	switch (sinfo->what) {
2e4e6a17	40	case XT_CONNBYTES_PKTS:
9d810fd2	41	switch (sinfo->direction) {
2e4e6a17	42	case XT_CONNBYTES_DIR_ORIGINAL:
9fb9cbb1	43	what = counters[IP_CT_DIR_ORIGINAL].packets;
9d810fd2	44	break;
2e4e6a17	45	case XT_CONNBYTES_DIR_REPLY:
9fb9cbb1	46	what = counters[IP_CT_DIR_REPLY].packets;
9d810fd2	47	break;
2e4e6a17	48	case XT_CONNBYTES_DIR_BOTH:
9fb9cbb1 YK	49	what = counters[IP_CT_DIR_ORIGINAL].packets;
9fb9cbb1 YK	50	what += counters[IP_CT_DIR_REPLY].packets;
9d810fd2 HW	51	break;
	52	}
	53	break;
2e4e6a17	54	case XT_CONNBYTES_BYTES:
9d810fd2	55	switch (sinfo->direction) {
2e4e6a17	56	case XT_CONNBYTES_DIR_ORIGINAL:
9fb9cbb1	57	what = counters[IP_CT_DIR_ORIGINAL].bytes;
9d810fd2	58	break;
2e4e6a17	59	case XT_CONNBYTES_DIR_REPLY:
9fb9cbb1	60	what = counters[IP_CT_DIR_REPLY].bytes;
9d810fd2	61	break;
2e4e6a17	62	case XT_CONNBYTES_DIR_BOTH:
9fb9cbb1 YK	63	what = counters[IP_CT_DIR_ORIGINAL].bytes;
9fb9cbb1 YK	64	what += counters[IP_CT_DIR_REPLY].bytes;
9d810fd2 HW	65	break;
	66	}
	67	break;
2e4e6a17	68	case XT_CONNBYTES_AVGPKT:
9d810fd2	69	switch (sinfo->direction) {
2e4e6a17	70	case XT_CONNBYTES_DIR_ORIGINAL:
fb74a841 PM	71	bytes = counters[IP_CT_DIR_ORIGINAL].bytes;
fb74a841 PM	72	pkts = counters[IP_CT_DIR_ORIGINAL].packets;
9d810fd2	73	break;
2e4e6a17	74	case XT_CONNBYTES_DIR_REPLY:
fb74a841 PM	75	bytes = counters[IP_CT_DIR_REPLY].bytes;
fb74a841 PM	76	pkts = counters[IP_CT_DIR_REPLY].packets;
9d810fd2	77	break;
2e4e6a17	78	case XT_CONNBYTES_DIR_BOTH:
fb74a841 PM	79	bytes = counters[IP_CT_DIR_ORIGINAL].bytes +
	80	counters[IP_CT_DIR_REPLY].bytes;
	81	pkts = counters[IP_CT_DIR_ORIGINAL].packets +
	82	counters[IP_CT_DIR_REPLY].packets;
9d810fd2 HW	83	break;
9d810fd2 HW	84	}
fb74a841	85	if (pkts != 0)
6f6d6a1a	86	what = div64_u64(bytes, pkts);
9d810fd2 HW	87	break;
	88	}
	89
	90	if (sinfo->count.to)
7c4e36bc	91	return what <= sinfo->count.to && what >= sinfo->count.from;
9d810fd2	92	else
7c4e36bc	93	return what >= sinfo->count.from;
9d810fd2 HW	94	}
9d810fd2 HW	95
b0f38452	96	static int connbytes_mt_check(const struct xt_mtchk_param *par)
9d810fd2	97	{
9b4fce7a	98	const struct xt_connbytes_info *sinfo = par->matchinfo;
4a5a5c73	99	int ret;
9d810fd2	100
2e4e6a17 HW	101	if (sinfo->what != XT_CONNBYTES_PKTS &&
	102	sinfo->what != XT_CONNBYTES_BYTES &&
	103	sinfo->what != XT_CONNBYTES_AVGPKT)
bd414ee6	104	return -EINVAL;
9d810fd2	105
2e4e6a17 HW	106	if (sinfo->direction != XT_CONNBYTES_DIR_ORIGINAL &&
	107	sinfo->direction != XT_CONNBYTES_DIR_REPLY &&
	108	sinfo->direction != XT_CONNBYTES_DIR_BOTH)
bd414ee6	109	return -EINVAL;
9d810fd2	110
4a5a5c73	111	ret = nf_ct_l3proto_try_module_get(par->family);
f95c74e3	112	if (ret < 0)
8bee4bad JE	113	pr_info("cannot load conntrack support for proto=%u\n",
8bee4bad JE	114	par->family);
f95c74e3	115	return ret;
9d810fd2 HW	116	}
9d810fd2 HW	117
6be3d859	118	static void connbytes_mt_destroy(const struct xt_mtdtor_param *par)
11078c37	119	{
92f3b2b1	120	nf_ct_l3proto_module_put(par->family);
11078c37 YK	121	}
11078c37 YK	122
92f3b2b1 JE	123	static struct xt_match connbytes_mt_reg __read_mostly = {
	124	.name = "connbytes",
	125	.revision = 0,
	126	.family = NFPROTO_UNSPEC,
	127	.checkentry = connbytes_mt_check,
	128	.match = connbytes_mt,
	129	.destroy = connbytes_mt_destroy,
	130	.matchsize = sizeof(struct xt_connbytes_info),
	131	.me = THIS_MODULE,
9d810fd2 HW	132	};
9d810fd2 HW	133
d3c5ee6d	134	static int __init connbytes_mt_init(void)
9d810fd2	135	{
92f3b2b1	136	return xt_register_match(&connbytes_mt_reg);
9d810fd2 HW	137	}
9d810fd2 HW	138
d3c5ee6d	139	static void __exit connbytes_mt_exit(void)
9d810fd2	140	{
92f3b2b1	141	xt_unregister_match(&connbytes_mt_reg);
9d810fd2 HW	142	}
9d810fd2 HW	143
d3c5ee6d JE	144	module_init(connbytes_mt_init);
d3c5ee6d JE	145	module_exit(connbytes_mt_exit);