[mirror_ubuntu-hirsute-kernel.git] / net / netfilter / xt_connbytes.c

/* Kernel module to match connection tracking byte counter.
 * GPL (C) 2002 Martin Devera (devik@cdi.cz).
 */
#include <linux/module.h>
#include <linux/bitops.h>
#include <linux/skbuff.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_connbytes.h>
#include <net/netfilter/nf_conntrack.h>

#include <asm/div64.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("iptables match for matching number of pkts/bytes per connection");
MODULE_ALIAS("ipt_connbytes");
MODULE_ALIAS("ip6t_connbytes");

static bool
connbytes_mt(const struct sk_buff *skb, const struct net_device *in,
             const struct net_device *out, const struct xt_match *match,
             const void *matchinfo, int offset, unsigned int protoff,
             bool *hotdrop)
{
	const struct xt_connbytes_info *sinfo = matchinfo;
	const struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
	u_int64_t what = 0;	/* initialize to make gcc happy */
	u_int64_t bytes = 0;
	u_int64_t pkts = 0;
	const struct ip_conntrack_counter *counters;

	ct = nf_ct_get(skb, &ctinfo);
	if (!ct)
		return false;
	counters = ct->counters;

	switch (sinfo->what) {
	case XT_CONNBYTES_PKTS:
		switch (sinfo->direction) {
		case XT_CONNBYTES_DIR_ORIGINAL:
			what = counters[IP_CT_DIR_ORIGINAL].packets;
			break;
		case XT_CONNBYTES_DIR_REPLY:
			what = counters[IP_CT_DIR_REPLY].packets;
			break;
		case XT_CONNBYTES_DIR_BOTH:
			what = counters[IP_CT_DIR_ORIGINAL].packets;
			what += counters[IP_CT_DIR_REPLY].packets;
			break;
		}
		break;
	case XT_CONNBYTES_BYTES:
		switch (sinfo->direction) {
		case XT_CONNBYTES_DIR_ORIGINAL:
			what = counters[IP_CT_DIR_ORIGINAL].bytes;
			break;
		case XT_CONNBYTES_DIR_REPLY:
			what = counters[IP_CT_DIR_REPLY].bytes;
			break;
		case XT_CONNBYTES_DIR_BOTH:
			what = counters[IP_CT_DIR_ORIGINAL].bytes;
			what += counters[IP_CT_DIR_REPLY].bytes;
			break;
		}
		break;
	case XT_CONNBYTES_AVGPKT:
		switch (sinfo->direction) {
		case XT_CONNBYTES_DIR_ORIGINAL:
			bytes = counters[IP_CT_DIR_ORIGINAL].bytes;
			pkts  = counters[IP_CT_DIR_ORIGINAL].packets;
			break;
		case XT_CONNBYTES_DIR_REPLY:
			bytes = counters[IP_CT_DIR_REPLY].bytes;
			pkts  = counters[IP_CT_DIR_REPLY].packets;
			break;
		case XT_CONNBYTES_DIR_BOTH:
			bytes = counters[IP_CT_DIR_ORIGINAL].bytes +
				counters[IP_CT_DIR_REPLY].bytes;
			pkts  = counters[IP_CT_DIR_ORIGINAL].packets +
				counters[IP_CT_DIR_REPLY].packets;
			break;
		}
		if (pkts != 0)
			what = div64_64(bytes, pkts);
		break;
	}

	if (sinfo->count.to)
		return what <= sinfo->count.to && what >= sinfo->count.from;
	else
		return what >= sinfo->count.from;
}

static bool
connbytes_mt_check(const char *tablename, const void *ip,
                   const struct xt_match *match, void *matchinfo,
                   unsigned int hook_mask)
{
	const struct xt_connbytes_info *sinfo = matchinfo;

	if (sinfo->what != XT_CONNBYTES_PKTS &&
	    sinfo->what != XT_CONNBYTES_BYTES &&
	    sinfo->what != XT_CONNBYTES_AVGPKT)
		return false;

	if (sinfo->direction != XT_CONNBYTES_DIR_ORIGINAL &&
	    sinfo->direction != XT_CONNBYTES_DIR_REPLY &&
	    sinfo->direction != XT_CONNBYTES_DIR_BOTH)
		return false;

	if (nf_ct_l3proto_try_module_get(match->family) < 0) {
		printk(KERN_WARNING "can't load conntrack support for "
				    "proto=%u\n", match->family);
		return false;
	}

	return true;
}

static void
connbytes_mt_destroy(const struct xt_match *match, void *matchinfo)
{
	nf_ct_l3proto_module_put(match->family);
}

static struct xt_match connbytes_mt_reg[] __read_mostly = {
	{
		.name		= "connbytes",
		.family		= AF_INET,
		.checkentry	= connbytes_mt_check,
		.match		= connbytes_mt,
		.destroy	= connbytes_mt_destroy,
		.matchsize	= sizeof(struct xt_connbytes_info),
		.me		= THIS_MODULE
	},
	{
		.name		= "connbytes",
		.family		= AF_INET6,
		.checkentry	= connbytes_mt_check,
		.match		= connbytes_mt,
		.destroy	= connbytes_mt_destroy,
		.matchsize	= sizeof(struct xt_connbytes_info),
		.me		= THIS_MODULE
	},
};

static int __init connbytes_mt_init(void)
{
	return xt_register_matches(connbytes_mt_reg,
	       ARRAY_SIZE(connbytes_mt_reg));
}

static void __exit connbytes_mt_exit(void)
{
	xt_unregister_matches(connbytes_mt_reg, ARRAY_SIZE(connbytes_mt_reg));
}

module_init(connbytes_mt_init);
module_exit(connbytes_mt_exit);
Commit	Line	Data
9d810fd2 HW	1	/* Kernel module to match connection tracking byte counter.
9d810fd2 HW	2	* GPL (C) 2002 Martin Devera (devik@cdi.cz).
9d810fd2 HW	3	*/
9d810fd2 HW	4	#include <linux/module.h>
1977f032	5	#include <linux/bitops.h>
9d810fd2	6	#include <linux/skbuff.h>
2e4e6a17 HW	7	#include <linux/netfilter/x_tables.h>
2e4e6a17 HW	8	#include <linux/netfilter/xt_connbytes.h>
587aa641	9	#include <net/netfilter/nf_conntrack.h>
9d810fd2 HW	10
9d810fd2 HW	11	#include <asm/div64.h>
9d810fd2 HW	12
	13	MODULE_LICENSE("GPL");
	14	MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
	15	MODULE_DESCRIPTION("iptables match for matching number of pkts/bytes per connection");
2e4e6a17	16	MODULE_ALIAS("ipt_connbytes");
73aaf935	17	MODULE_ALIAS("ip6t_connbytes");
9d810fd2	18
1d93a9cb	19	static bool
d3c5ee6d JE	20	connbytes_mt(const struct sk_buff skb, const struct net_device in,
	21	const struct net_device out, const struct xt_match match,
	22	const void *matchinfo, int offset, unsigned int protoff,
	23	bool *hotdrop)
9d810fd2	24	{
2e4e6a17	25	const struct xt_connbytes_info *sinfo = matchinfo;
a47362a2	26	const struct nf_conn *ct;
587aa641	27	enum ip_conntrack_info ctinfo;
9d810fd2	28	u_int64_t what = 0; /* initialize to make gcc happy */
fb74a841 PM	29	u_int64_t bytes = 0;
fb74a841 PM	30	u_int64_t pkts = 0;
9fb9cbb1	31	const struct ip_conntrack_counter *counters;
9d810fd2	32
587aa641 PM	33	ct = nf_ct_get(skb, &ctinfo);
587aa641 PM	34	if (!ct)
1d93a9cb	35	return false;
587aa641	36	counters = ct->counters;
9d810fd2 HW	37
9d810fd2 HW	38	switch (sinfo->what) {
2e4e6a17	39	case XT_CONNBYTES_PKTS:
9d810fd2	40	switch (sinfo->direction) {
2e4e6a17	41	case XT_CONNBYTES_DIR_ORIGINAL:
9fb9cbb1	42	what = counters[IP_CT_DIR_ORIGINAL].packets;
9d810fd2	43	break;
2e4e6a17	44	case XT_CONNBYTES_DIR_REPLY:
9fb9cbb1	45	what = counters[IP_CT_DIR_REPLY].packets;
9d810fd2	46	break;
2e4e6a17	47	case XT_CONNBYTES_DIR_BOTH:
9fb9cbb1 YK	48	what = counters[IP_CT_DIR_ORIGINAL].packets;
9fb9cbb1 YK	49	what += counters[IP_CT_DIR_REPLY].packets;
9d810fd2 HW	50	break;
	51	}
	52	break;
2e4e6a17	53	case XT_CONNBYTES_BYTES:
9d810fd2	54	switch (sinfo->direction) {
2e4e6a17	55	case XT_CONNBYTES_DIR_ORIGINAL:
9fb9cbb1	56	what = counters[IP_CT_DIR_ORIGINAL].bytes;
9d810fd2	57	break;
2e4e6a17	58	case XT_CONNBYTES_DIR_REPLY:
9fb9cbb1	59	what = counters[IP_CT_DIR_REPLY].bytes;
9d810fd2	60	break;
2e4e6a17	61	case XT_CONNBYTES_DIR_BOTH:
9fb9cbb1 YK	62	what = counters[IP_CT_DIR_ORIGINAL].bytes;
9fb9cbb1 YK	63	what += counters[IP_CT_DIR_REPLY].bytes;
9d810fd2 HW	64	break;
	65	}
	66	break;
2e4e6a17	67	case XT_CONNBYTES_AVGPKT:
9d810fd2	68	switch (sinfo->direction) {
2e4e6a17	69	case XT_CONNBYTES_DIR_ORIGINAL:
fb74a841 PM	70	bytes = counters[IP_CT_DIR_ORIGINAL].bytes;
fb74a841 PM	71	pkts = counters[IP_CT_DIR_ORIGINAL].packets;
9d810fd2	72	break;
2e4e6a17	73	case XT_CONNBYTES_DIR_REPLY:
fb74a841 PM	74	bytes = counters[IP_CT_DIR_REPLY].bytes;
fb74a841 PM	75	pkts = counters[IP_CT_DIR_REPLY].packets;
9d810fd2	76	break;
2e4e6a17	77	case XT_CONNBYTES_DIR_BOTH:
fb74a841 PM	78	bytes = counters[IP_CT_DIR_ORIGINAL].bytes +
	79	counters[IP_CT_DIR_REPLY].bytes;
	80	pkts = counters[IP_CT_DIR_ORIGINAL].packets +
	81	counters[IP_CT_DIR_REPLY].packets;
9d810fd2 HW	82	break;
9d810fd2 HW	83	}
fb74a841 PM	84	if (pkts != 0)
fb74a841 PM	85	what = div64_64(bytes, pkts);
9d810fd2 HW	86	break;
	87	}
	88
	89	if (sinfo->count.to)
7c4e36bc	90	return what <= sinfo->count.to && what >= sinfo->count.from;
9d810fd2	91	else
7c4e36bc	92	return what >= sinfo->count.from;
9d810fd2 HW	93	}
9d810fd2 HW	94
d3c5ee6d JE	95	static bool
	96	connbytes_mt_check(const char tablename, const void ip,
	97	const struct xt_match match, void matchinfo,
	98	unsigned int hook_mask)
9d810fd2	99	{
2e4e6a17	100	const struct xt_connbytes_info *sinfo = matchinfo;
9d810fd2	101
2e4e6a17 HW	102	if (sinfo->what != XT_CONNBYTES_PKTS &&
	103	sinfo->what != XT_CONNBYTES_BYTES &&
	104	sinfo->what != XT_CONNBYTES_AVGPKT)
ccb79bdc	105	return false;
9d810fd2	106
2e4e6a17 HW	107	if (sinfo->direction != XT_CONNBYTES_DIR_ORIGINAL &&
	108	sinfo->direction != XT_CONNBYTES_DIR_REPLY &&
	109	sinfo->direction != XT_CONNBYTES_DIR_BOTH)
ccb79bdc	110	return false;
9d810fd2	111
11078c37 YK	112	if (nf_ct_l3proto_try_module_get(match->family) < 0) {
11078c37 YK	113	printk(KERN_WARNING "can't load conntrack support for "
df54aae0	114	"proto=%u\n", match->family);
ccb79bdc	115	return false;
11078c37 YK	116	}
11078c37 YK	117
ccb79bdc	118	return true;
9d810fd2 HW	119	}
9d810fd2 HW	120
11078c37	121	static void
d3c5ee6d	122	connbytes_mt_destroy(const struct xt_match match, void matchinfo)
11078c37 YK	123	{
	124	nf_ct_l3proto_module_put(match->family);
	125	}
	126
d3c5ee6d	127	static struct xt_match connbytes_mt_reg[] __read_mostly = {
4470bbc7 PM	128	{
	129	.name = "connbytes",
	130	.family = AF_INET,
d3c5ee6d JE	131	.checkentry = connbytes_mt_check,
	132	.match = connbytes_mt,
	133	.destroy = connbytes_mt_destroy,
4470bbc7 PM	134	.matchsize = sizeof(struct xt_connbytes_info),
	135	.me = THIS_MODULE
	136	},
	137	{
	138	.name = "connbytes",
	139	.family = AF_INET6,
d3c5ee6d JE	140	.checkentry = connbytes_mt_check,
	141	.match = connbytes_mt,
	142	.destroy = connbytes_mt_destroy,
4470bbc7 PM	143	.matchsize = sizeof(struct xt_connbytes_info),
	144	.me = THIS_MODULE
	145	},
9d810fd2 HW	146	};
9d810fd2 HW	147
d3c5ee6d	148	static int __init connbytes_mt_init(void)
9d810fd2	149	{
d3c5ee6d JE	150	return xt_register_matches(connbytes_mt_reg,
d3c5ee6d JE	151	ARRAY_SIZE(connbytes_mt_reg));
9d810fd2 HW	152	}
9d810fd2 HW	153
d3c5ee6d	154	static void __exit connbytes_mt_exit(void)
9d810fd2	155	{
d3c5ee6d	156	xt_unregister_matches(connbytes_mt_reg, ARRAY_SIZE(connbytes_mt_reg));
9d810fd2 HW	157	}
9d810fd2 HW	158
d3c5ee6d JE	159	module_init(connbytes_mt_init);
d3c5ee6d JE	160	module_exit(connbytes_mt_exit);