[deliverable/linux.git] / net / ipv4 / netfilter / ipt_connbytes.c

/* Kernel module to match connection tracking byte counter.
 * GPL (C) 2002 Martin Devera (devik@cdi.cz).
 *
 * 2004-07-20 Harald Welte <laforge@netfilter.org>
 * 	- reimplemented to use per-connection accounting counters
 * 	- add functionality to match number of packets
 * 	- add functionality to match average packet size
 * 	- add support to match directions seperately
 *
 */
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/netfilter_ipv4/ip_conntrack.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ipt_connbytes.h>

#include <asm/div64.h>
#include <asm/bitops.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("iptables match for matching number of pkts/bytes per connection");

/* 64bit divisor, dividend and result. dynamic precision */
static u_int64_t div64_64(u_int64_t divisor, u_int64_t dividend)
{
	u_int64_t result = divisor;

	if (dividend > 0xffffffff) {
		int first_bit = find_first_bit((unsigned long *) &dividend, sizeof(dividend));
		/* calculate number of bits to shift. shift exactly enough
		 * bits to make dividend fit in 32bits. */
		int num_shift = (64 - 32 - first_bit);
		/* first bit has to be < 32, since dividend was > 0xffffffff */
		result = result >> num_shift;
		dividend = dividend >> num_shift;
	}

	do_div(divisor, dividend);

	return divisor;
}

static int
match(const struct sk_buff *skb,
      const struct net_device *in,
      const struct net_device *out,
      const void *matchinfo,
      int offset,
      int *hotdrop)
{
	const struct ipt_connbytes_info *sinfo = matchinfo;
	enum ip_conntrack_info ctinfo;
	struct ip_conntrack *ct;
	u_int64_t what = 0;	/* initialize to make gcc happy */

	if (!(ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo)))
		return 0; /* no match */

	switch (sinfo->what) {
	case IPT_CONNBYTES_WHAT_PKTS:
		switch (sinfo->direction) {
		case IPT_CONNBYTES_DIR_ORIGINAL:
			what = ct->counters[IP_CT_DIR_ORIGINAL].packets;
			break;
		case IPT_CONNBYTES_DIR_REPLY:
			what = ct->counters[IP_CT_DIR_REPLY].packets;
			break;
		case IPT_CONNBYTES_DIR_BOTH:
			what = ct->counters[IP_CT_DIR_ORIGINAL].packets;
			what += ct->counters[IP_CT_DIR_REPLY].packets;
			break;
		}
		break;
	case IPT_CONNBYTES_WHAT_BYTES:
		switch (sinfo->direction) {
		case IPT_CONNBYTES_DIR_ORIGINAL:
			what = ct->counters[IP_CT_DIR_ORIGINAL].bytes;
			break;
		case IPT_CONNBYTES_DIR_REPLY:
			what = ct->counters[IP_CT_DIR_REPLY].bytes;
			break;
		case IPT_CONNBYTES_DIR_BOTH:
			what = ct->counters[IP_CT_DIR_ORIGINAL].bytes;
			what += ct->counters[IP_CT_DIR_REPLY].bytes;
			break;
		}
		break;
	case IPT_CONNBYTES_WHAT_AVGPKT:
		switch (sinfo->direction) {
		case IPT_CONNBYTES_DIR_ORIGINAL:
			what = div64_64(ct->counters[IP_CT_DIR_ORIGINAL].bytes,
					ct->counters[IP_CT_DIR_ORIGINAL].packets);
			break;
		case IPT_CONNBYTES_DIR_REPLY:
			what = div64_64(ct->counters[IP_CT_DIR_REPLY].bytes,
					ct->counters[IP_CT_DIR_REPLY].packets);
			break;
		case IPT_CONNBYTES_DIR_BOTH:
			{
				u_int64_t bytes;
				u_int64_t pkts;
				bytes = ct->counters[IP_CT_DIR_ORIGINAL].bytes +
					ct->counters[IP_CT_DIR_REPLY].bytes;
				pkts = ct->counters[IP_CT_DIR_ORIGINAL].packets+
					ct->counters[IP_CT_DIR_REPLY].packets;

				/* FIXME_THEORETICAL: what to do if sum
				 * overflows ? */

				what = div64_64(bytes, pkts);
			}
			break;
		}
		break;
	}

	if (sinfo->count.to)
		return (what <= sinfo->count.to && what >= sinfo->count.from);
	else
		return (what >= sinfo->count.from);
}

static int check(const char *tablename,
		 const struct ipt_ip *ip,
		 void *matchinfo,
		 unsigned int matchsize,
		 unsigned int hook_mask)
{
	const struct ipt_connbytes_info *sinfo = matchinfo;

	if (matchsize != IPT_ALIGN(sizeof(struct ipt_connbytes_info)))
		return 0;

	if (sinfo->what != IPT_CONNBYTES_WHAT_PKTS &&
	    sinfo->what != IPT_CONNBYTES_WHAT_BYTES &&
	    sinfo->what != IPT_CONNBYTES_WHAT_AVGPKT)
		return 0;

	if (sinfo->direction != IPT_CONNBYTES_DIR_ORIGINAL &&
	    sinfo->direction != IPT_CONNBYTES_DIR_REPLY &&
	    sinfo->direction != IPT_CONNBYTES_DIR_BOTH)
		return 0;

	return 1;
}

static struct ipt_match state_match = {
	.name		= "connbytes",
	.match		= &match,
	.checkentry	= &check,
	.me		= THIS_MODULE
};

static int __init init(void)
{
	return ipt_register_match(&state_match);
}

static void __exit fini(void)
{
	ipt_unregister_match(&state_match);
}

module_init(init);
module_exit(fini);
Commit	Line	Data
9d810fd2 HW	1	/* Kernel module to match connection tracking byte counter.
	2	* GPL (C) 2002 Martin Devera (devik@cdi.cz).
	3	*
	4	* 2004-07-20 Harald Welte <laforge@netfilter.org>
	5	* - reimplemented to use per-connection accounting counters
	6	* - add functionality to match number of packets
	7	* - add functionality to match average packet size
	8	* - add support to match directions seperately
	9	*
	10	*/
	11	#include <linux/module.h>
	12	#include <linux/skbuff.h>
	13	#include <linux/netfilter_ipv4/ip_conntrack.h>
	14	#include <linux/netfilter_ipv4/ip_tables.h>
	15	#include <linux/netfilter_ipv4/ipt_connbytes.h>
	16
	17	#include <asm/div64.h>
	18	#include <asm/bitops.h>
	19
	20	MODULE_LICENSE("GPL");
	21	MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
	22	MODULE_DESCRIPTION("iptables match for matching number of pkts/bytes per connection");
	23
	24	/* 64bit divisor, dividend and result. dynamic precision */
	25	static u_int64_t div64_64(u_int64_t divisor, u_int64_t dividend)
	26	{
	27	u_int64_t result = divisor;
	28
	29	if (dividend > 0xffffffff) {
	30	int first_bit = find_first_bit((unsigned long *) &dividend, sizeof(dividend));
	31	/* calculate number of bits to shift. shift exactly enough
	32	* bits to make dividend fit in 32bits. */
	33	int num_shift = (64 - 32 - first_bit);
	34	/* first bit has to be < 32, since dividend was > 0xffffffff */
	35	result = result >> num_shift;
	36	dividend = dividend >> num_shift;
	37	}
	38
	39	do_div(divisor, dividend);
	40
	41	return divisor;
	42	}
	43
	44	static int
	45	match(const struct sk_buff *skb,
	46	const struct net_device *in,
	47	const struct net_device *out,
	48	const void *matchinfo,
	49	int offset,
	50	int *hotdrop)
	51	{
	52	const struct ipt_connbytes_info *sinfo = matchinfo;
	53	enum ip_conntrack_info ctinfo;
	54	struct ip_conntrack *ct;
	55	u_int64_t what = 0; /* initialize to make gcc happy */
	56
	57	if (!(ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo)))
	58	return 0; /* no match */
	59
	60	switch (sinfo->what) {
	61	case IPT_CONNBYTES_WHAT_PKTS:
	62	switch (sinfo->direction) {
	63	case IPT_CONNBYTES_DIR_ORIGINAL:
	64	what = ct->counters[IP_CT_DIR_ORIGINAL].packets;
65	break;
66	case IPT_CONNBYTES_DIR_REPLY:
67	what = ct->counters[IP_CT_DIR_REPLY].packets;
68	break;
69	case IPT_CONNBYTES_DIR_BOTH:
70	what = ct->counters[IP_CT_DIR_ORIGINAL].packets;
71	what += ct->counters[IP_CT_DIR_REPLY].packets;
72	break;
73	}
74	break;
75	case IPT_CONNBYTES_WHAT_BYTES:
76	switch (sinfo->direction) {
77	case IPT_CONNBYTES_DIR_ORIGINAL:
78	what = ct->counters[IP_CT_DIR_ORIGINAL].bytes;
79	break;
80	case IPT_CONNBYTES_DIR_REPLY:
81	what = ct->counters[IP_CT_DIR_REPLY].bytes;
82	break;
83	case IPT_CONNBYTES_DIR_BOTH:
84	what = ct->counters[IP_CT_DIR_ORIGINAL].bytes;
85	what += ct->counters[IP_CT_DIR_REPLY].bytes;
86	break;
87	}
88	break;
89	case IPT_CONNBYTES_WHAT_AVGPKT:
90	switch (sinfo->direction) {
91	case IPT_CONNBYTES_DIR_ORIGINAL:
92	what = div64_64(ct->counters[IP_CT_DIR_ORIGINAL].bytes,
93	ct->counters[IP_CT_DIR_ORIGINAL].packets);
94	break;
95	case IPT_CONNBYTES_DIR_REPLY:
96	what = div64_64(ct->counters[IP_CT_DIR_REPLY].bytes,
97	ct->counters[IP_CT_DIR_REPLY].packets);
98	break;
99	case IPT_CONNBYTES_DIR_BOTH:
100	{
101	u_int64_t bytes;
102	u_int64_t pkts;
103	bytes = ct->counters[IP_CT_DIR_ORIGINAL].bytes +
104	ct->counters[IP_CT_DIR_REPLY].bytes;
105	pkts = ct->counters[IP_CT_DIR_ORIGINAL].packets+
106	ct->counters[IP_CT_DIR_REPLY].packets;
107
108	/* FIXME_THEORETICAL: what to do if sum
109	* overflows ? */
110
111	what = div64_64(bytes, pkts);
112	}
113	break;
114	}
115	break;
116	}
117
118	if (sinfo->count.to)
119	return (what <= sinfo->count.to && what >= sinfo->count.from);
120	else
121	return (what >= sinfo->count.from);
122	}
123
124	static int check(const char *tablename,
125	const struct ipt_ip *ip,
126	void *matchinfo,
127	unsigned int matchsize,
128	unsigned int hook_mask)
129	{
130	const struct ipt_connbytes_info *sinfo = matchinfo;
131
132	if (matchsize != IPT_ALIGN(sizeof(struct ipt_connbytes_info)))
133	return 0;
134
135	if (sinfo->what != IPT_CONNBYTES_WHAT_PKTS &&
136	sinfo->what != IPT_CONNBYTES_WHAT_BYTES &&
137	sinfo->what != IPT_CONNBYTES_WHAT_AVGPKT)
138	return 0;
139
140	if (sinfo->direction != IPT_CONNBYTES_DIR_ORIGINAL &&
141	sinfo->direction != IPT_CONNBYTES_DIR_REPLY &&
142	sinfo->direction != IPT_CONNBYTES_DIR_BOTH)
143	return 0;
144
145	return 1;
146	}
147
148	static struct ipt_match state_match = {
149	.name = "connbytes",
150	.match = &match,
151	.checkentry = &check,
152	.me = THIS_MODULE
153	};
154
155	static int __init init(void)
156	{
157	return ipt_register_match(&state_match);
158	}
159
160	static void __exit fini(void)
161	{
162	ipt_unregister_match(&state_match);
163	}
164
165	module_init(init);
166	module_exit(fini);