[mirror_ubuntu-hirsute-kernel.git] / net / ipv4 / netfilter / ipt_connbytes.c

/* Kernel module to match connection tracking byte counter.
 * GPL (C) 2002 Martin Devera (devik@cdi.cz).
 *
 * 2004-07-20 Harald Welte <laforge@netfilter.org>
 * 	- reimplemented to use per-connection accounting counters
 * 	- add functionality to match number of packets
 * 	- add functionality to match average packet size
 * 	- add support to match directions seperately
 *
 */
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/netfilter_ipv4/ip_conntrack.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ipt_connbytes.h>

#include <asm/div64.h>
#include <asm/bitops.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("iptables match for matching number of pkts/bytes per connection");

/* 64bit divisor, dividend and result. dynamic precision */
static u_int64_t div64_64(u_int64_t dividend, u_int64_t divisor)
{
	u_int32_t d = divisor;

	if (divisor > 0xffffffffULL) {
		unsigned int shift = fls(divisor >> 32);

		d = divisor >> shift;
		dividend >>= shift;
	}

	do_div(dividend, d);
	return dividend;
}

static int
match(const struct sk_buff *skb,
      const struct net_device *in,
      const struct net_device *out,
      const void *matchinfo,
      int offset,
      int *hotdrop)
{
	const struct ipt_connbytes_info *sinfo = matchinfo;
	enum ip_conntrack_info ctinfo;
	struct ip_conntrack *ct;
	u_int64_t what = 0;	/* initialize to make gcc happy */

	if (!(ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo)))
		return 0; /* no match */

	switch (sinfo->what) {
	case IPT_CONNBYTES_PKTS:
		switch (sinfo->direction) {
		case IPT_CONNBYTES_DIR_ORIGINAL:
			what = ct->counters[IP_CT_DIR_ORIGINAL].packets;
			break;
		case IPT_CONNBYTES_DIR_REPLY:
			what = ct->counters[IP_CT_DIR_REPLY].packets;
			break;
		case IPT_CONNBYTES_DIR_BOTH:
			what = ct->counters[IP_CT_DIR_ORIGINAL].packets;
			what += ct->counters[IP_CT_DIR_REPLY].packets;
			break;
		}
		break;
	case IPT_CONNBYTES_BYTES:
		switch (sinfo->direction) {
		case IPT_CONNBYTES_DIR_ORIGINAL:
			what = ct->counters[IP_CT_DIR_ORIGINAL].bytes;
			break;
		case IPT_CONNBYTES_DIR_REPLY:
			what = ct->counters[IP_CT_DIR_REPLY].bytes;
			break;
		case IPT_CONNBYTES_DIR_BOTH:
			what = ct->counters[IP_CT_DIR_ORIGINAL].bytes;
			what += ct->counters[IP_CT_DIR_REPLY].bytes;
			break;
		}
		break;
	case IPT_CONNBYTES_AVGPKT:
		switch (sinfo->direction) {
		case IPT_CONNBYTES_DIR_ORIGINAL:
			what = div64_64(ct->counters[IP_CT_DIR_ORIGINAL].bytes,
					ct->counters[IP_CT_DIR_ORIGINAL].packets);
			break;
		case IPT_CONNBYTES_DIR_REPLY:
			what = div64_64(ct->counters[IP_CT_DIR_REPLY].bytes,
					ct->counters[IP_CT_DIR_REPLY].packets);
			break;
		case IPT_CONNBYTES_DIR_BOTH:
			{
				u_int64_t bytes;
				u_int64_t pkts;
				bytes = ct->counters[IP_CT_DIR_ORIGINAL].bytes +
					ct->counters[IP_CT_DIR_REPLY].bytes;
				pkts = ct->counters[IP_CT_DIR_ORIGINAL].packets+
					ct->counters[IP_CT_DIR_REPLY].packets;

				/* FIXME_THEORETICAL: what to do if sum
				 * overflows ? */

				what = div64_64(bytes, pkts);
			}
			break;
		}
		break;
	}

	if (sinfo->count.to)
		return (what <= sinfo->count.to && what >= sinfo->count.from);
	else
		return (what >= sinfo->count.from);
}

static int check(const char *tablename,
		 const struct ipt_ip *ip,
		 void *matchinfo,
		 unsigned int matchsize,
		 unsigned int hook_mask)
{
	const struct ipt_connbytes_info *sinfo = matchinfo;

	if (matchsize != IPT_ALIGN(sizeof(struct ipt_connbytes_info)))
		return 0;

	if (sinfo->what != IPT_CONNBYTES_PKTS &&
	    sinfo->what != IPT_CONNBYTES_BYTES &&
	    sinfo->what != IPT_CONNBYTES_AVGPKT)
		return 0;

	if (sinfo->direction != IPT_CONNBYTES_DIR_ORIGINAL &&
	    sinfo->direction != IPT_CONNBYTES_DIR_REPLY &&
	    sinfo->direction != IPT_CONNBYTES_DIR_BOTH)
		return 0;

	return 1;
}

static struct ipt_match state_match = {
	.name		= "connbytes",
	.match		= &match,
	.checkentry	= &check,
	.me		= THIS_MODULE
};

static int __init init(void)
{
	return ipt_register_match(&state_match);
}

static void __exit fini(void)
{
	ipt_unregister_match(&state_match);
}

module_init(init);
module_exit(fini);
Commit	Line	Data
9d810fd2 HW	1	/* Kernel module to match connection tracking byte counter.
	2	* GPL (C) 2002 Martin Devera (devik@cdi.cz).
	3	*
	4	* 2004-07-20 Harald Welte <laforge@netfilter.org>
	5	* - reimplemented to use per-connection accounting counters
	6	* - add functionality to match number of packets
	7	* - add functionality to match average packet size
	8	* - add support to match directions seperately
	9	*
	10	*/
	11	#include <linux/module.h>
	12	#include <linux/skbuff.h>
	13	#include <linux/netfilter_ipv4/ip_conntrack.h>
	14	#include <linux/netfilter_ipv4/ip_tables.h>
	15	#include <linux/netfilter_ipv4/ipt_connbytes.h>
	16
	17	#include <asm/div64.h>
	18	#include <asm/bitops.h>
	19
	20	MODULE_LICENSE("GPL");
	21	MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
	22	MODULE_DESCRIPTION("iptables match for matching number of pkts/bytes per connection");
	23
	24	/* 64bit divisor, dividend and result. dynamic precision */
8ffde671	25	static u_int64_t div64_64(u_int64_t dividend, u_int64_t divisor)
9d810fd2	26	{
8ffde671	27	u_int32_t d = divisor;
9d810fd2	28
8ffde671 PM	29	if (divisor > 0xffffffffULL) {
8ffde671 PM	30	unsigned int shift = fls(divisor >> 32);
9d810fd2	31
8ffde671 PM	32	d = divisor >> shift;
	33	dividend >>= shift;
	34	}
9d810fd2	35
8ffde671 PM	36	do_div(dividend, d);
8ffde671 PM	37	return dividend;
9d810fd2 HW	38	}
	39
	40	static int
	41	match(const struct sk_buff *skb,
	42	const struct net_device *in,
	43	const struct net_device *out,
	44	const void *matchinfo,
	45	int offset,
	46	int *hotdrop)
	47	{
	48	const struct ipt_connbytes_info *sinfo = matchinfo;
	49	enum ip_conntrack_info ctinfo;
	50	struct ip_conntrack *ct;
	51	u_int64_t what = 0; /* initialize to make gcc happy */
	52
	53	if (!(ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo)))
	54	return 0; /* no match */
	55
	56	switch (sinfo->what) {
25ed8910	57	case IPT_CONNBYTES_PKTS:
9d810fd2 HW	58	switch (sinfo->direction) {
	59	case IPT_CONNBYTES_DIR_ORIGINAL:
	60	what = ct->counters[IP_CT_DIR_ORIGINAL].packets;
	61	break;
	62	case IPT_CONNBYTES_DIR_REPLY:
	63	what = ct->counters[IP_CT_DIR_REPLY].packets;
	64	break;
	65	case IPT_CONNBYTES_DIR_BOTH:
	66	what = ct->counters[IP_CT_DIR_ORIGINAL].packets;
	67	what += ct->counters[IP_CT_DIR_REPLY].packets;
	68	break;
	69	}
	70	break;
25ed8910	71	case IPT_CONNBYTES_BYTES:
9d810fd2 HW	72	switch (sinfo->direction) {
	73	case IPT_CONNBYTES_DIR_ORIGINAL:
	74	what = ct->counters[IP_CT_DIR_ORIGINAL].bytes;
	75	break;
	76	case IPT_CONNBYTES_DIR_REPLY:
	77	what = ct->counters[IP_CT_DIR_REPLY].bytes;
	78	break;
	79	case IPT_CONNBYTES_DIR_BOTH:
	80	what = ct->counters[IP_CT_DIR_ORIGINAL].bytes;
	81	what += ct->counters[IP_CT_DIR_REPLY].bytes;
	82	break;
	83	}
	84	break;
25ed8910	85	case IPT_CONNBYTES_AVGPKT:
9d810fd2 HW	86	switch (sinfo->direction) {
	87	case IPT_CONNBYTES_DIR_ORIGINAL:
	88	what = div64_64(ct->counters[IP_CT_DIR_ORIGINAL].bytes,
	89	ct->counters[IP_CT_DIR_ORIGINAL].packets);
	90	break;
	91	case IPT_CONNBYTES_DIR_REPLY:
	92	what = div64_64(ct->counters[IP_CT_DIR_REPLY].bytes,
	93	ct->counters[IP_CT_DIR_REPLY].packets);
	94	break;
	95	case IPT_CONNBYTES_DIR_BOTH:
	96	{
	97	u_int64_t bytes;
	98	u_int64_t pkts;
	99	bytes = ct->counters[IP_CT_DIR_ORIGINAL].bytes +
	100	ct->counters[IP_CT_DIR_REPLY].bytes;
	101	pkts = ct->counters[IP_CT_DIR_ORIGINAL].packets+
	102	ct->counters[IP_CT_DIR_REPLY].packets;
	103
	104	/* FIXME_THEORETICAL: what to do if sum
	105	* overflows ? */
	106
	107	what = div64_64(bytes, pkts);
	108	}
	109	break;
	110	}
	111	break;
	112	}
	113
	114	if (sinfo->count.to)
	115	return (what <= sinfo->count.to && what >= sinfo->count.from);
	116	else
	117	return (what >= sinfo->count.from);
	118	}
	119
	120	static int check(const char *tablename,
	121	const struct ipt_ip *ip,
	122	void *matchinfo,
	123	unsigned int matchsize,
	124	unsigned int hook_mask)
	125	{
	126	const struct ipt_connbytes_info *sinfo = matchinfo;
	127
	128	if (matchsize != IPT_ALIGN(sizeof(struct ipt_connbytes_info)))
	129	return 0;
	130
25ed8910 PM	131	if (sinfo->what != IPT_CONNBYTES_PKTS &&
	132	sinfo->what != IPT_CONNBYTES_BYTES &&
	133	sinfo->what != IPT_CONNBYTES_AVGPKT)
9d810fd2 HW	134	return 0;
	135
	136	if (sinfo->direction != IPT_CONNBYTES_DIR_ORIGINAL &&
	137	sinfo->direction != IPT_CONNBYTES_DIR_REPLY &&
	138	sinfo->direction != IPT_CONNBYTES_DIR_BOTH)
	139	return 0;
	140
	141	return 1;
	142	}
	143
	144	static struct ipt_match state_match = {
	145	.name = "connbytes",
	146	.match = &match,
	147	.checkentry = &check,
	148	.me = THIS_MODULE
	149	};
	150
	151	static int __init init(void)
	152	{
	153	return ipt_register_match(&state_match);
	154	}
	155
	156	static void __exit fini(void)
	157	{
	158	ipt_unregister_match(&state_match);
	159	}
	160
	161	module_init(init);
	162	module_exit(fini);