[deliverable/linux.git] / net / netfilter / xt_connbytes.c

/* Kernel module to match connection tracking byte counter.
 * GPL (C) 2002 Martin Devera (devik@cdi.cz).
 *
 * 2004-07-20 Harald Welte <laforge@netfilter.org>
 * 	- reimplemented to use per-connection accounting counters
 * 	- add functionality to match number of packets
 * 	- add functionality to match average packet size
 * 	- add support to match directions seperately
 * 2005-10-16 Harald Welte <laforge@netfilter.org>
 * 	- Port to x_tables
 *
 */
#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/netfilter/nf_conntrack_compat.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_connbytes.h>

#include <asm/div64.h>
#include <asm/bitops.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("iptables match for matching number of pkts/bytes per connection");
MODULE_ALIAS("ipt_connbytes");

/* 64bit divisor, dividend and result. dynamic precision */
static u_int64_t div64_64(u_int64_t dividend, u_int64_t divisor)
{
	u_int32_t d = divisor;

	if (divisor > 0xffffffffULL) {
		unsigned int shift = fls(divisor >> 32);

		d = divisor >> shift;
		dividend >>= shift;
	}

	do_div(dividend, d);
	return dividend;
}

static int
match(const struct sk_buff *skb,
      const struct net_device *in,
      const struct net_device *out,
      const struct xt_match *match,
      const void *matchinfo,
      int offset,
      unsigned int protoff,
      int *hotdrop)
{
	const struct xt_connbytes_info *sinfo = matchinfo;
	u_int64_t what = 0;	/* initialize to make gcc happy */
	const struct ip_conntrack_counter *counters;

	if (!(counters = nf_ct_get_counters(skb)))
		return 0; /* no match */

	switch (sinfo->what) {
	case XT_CONNBYTES_PKTS:
		switch (sinfo->direction) {
		case XT_CONNBYTES_DIR_ORIGINAL:
			what = counters[IP_CT_DIR_ORIGINAL].packets;
			break;
		case XT_CONNBYTES_DIR_REPLY:
			what = counters[IP_CT_DIR_REPLY].packets;
			break;
		case XT_CONNBYTES_DIR_BOTH:
			what = counters[IP_CT_DIR_ORIGINAL].packets;
			what += counters[IP_CT_DIR_REPLY].packets;
			break;
		}
		break;
	case XT_CONNBYTES_BYTES:
		switch (sinfo->direction) {
		case XT_CONNBYTES_DIR_ORIGINAL:
			what = counters[IP_CT_DIR_ORIGINAL].bytes;
			break;
		case XT_CONNBYTES_DIR_REPLY:
			what = counters[IP_CT_DIR_REPLY].bytes;
			break;
		case XT_CONNBYTES_DIR_BOTH:
			what = counters[IP_CT_DIR_ORIGINAL].bytes;
			what += counters[IP_CT_DIR_REPLY].bytes;
			break;
		}
		break;
	case XT_CONNBYTES_AVGPKT:
		switch (sinfo->direction) {
		case XT_CONNBYTES_DIR_ORIGINAL:
			what = div64_64(counters[IP_CT_DIR_ORIGINAL].bytes,
					counters[IP_CT_DIR_ORIGINAL].packets);
			break;
		case XT_CONNBYTES_DIR_REPLY:
			what = div64_64(counters[IP_CT_DIR_REPLY].bytes,
					counters[IP_CT_DIR_REPLY].packets);
			break;
		case XT_CONNBYTES_DIR_BOTH:
			{
				u_int64_t bytes;
				u_int64_t pkts;
				bytes = counters[IP_CT_DIR_ORIGINAL].bytes +
					counters[IP_CT_DIR_REPLY].bytes;
				pkts = counters[IP_CT_DIR_ORIGINAL].packets+
					counters[IP_CT_DIR_REPLY].packets;

				/* FIXME_THEORETICAL: what to do if sum
				 * overflows ? */

				what = div64_64(bytes, pkts);
			}
			break;
		}
		break;
	}

	if (sinfo->count.to)
		return (what <= sinfo->count.to && what >= sinfo->count.from);
	else
		return (what >= sinfo->count.from);
}

static int check(const char *tablename,
		 const void *ip,
		 const struct xt_match *match,
		 void *matchinfo,
		 unsigned int hook_mask)
{
	const struct xt_connbytes_info *sinfo = matchinfo;

	if (sinfo->what != XT_CONNBYTES_PKTS &&
	    sinfo->what != XT_CONNBYTES_BYTES &&
	    sinfo->what != XT_CONNBYTES_AVGPKT)
		return 0;

	if (sinfo->direction != XT_CONNBYTES_DIR_ORIGINAL &&
	    sinfo->direction != XT_CONNBYTES_DIR_REPLY &&
	    sinfo->direction != XT_CONNBYTES_DIR_BOTH)
		return 0;

	return 1;
}

static struct xt_match xt_connbytes_match[] = {
	{
		.name		= "connbytes",
		.family		= AF_INET,
		.checkentry	= check,
		.match		= match,
		.matchsize	= sizeof(struct xt_connbytes_info),
		.me		= THIS_MODULE
	},
	{
		.name		= "connbytes",
		.family		= AF_INET6,
		.checkentry	= check,
		.match		= match,
		.matchsize	= sizeof(struct xt_connbytes_info),
		.me		= THIS_MODULE
	},
};

static int __init xt_connbytes_init(void)
{
	return xt_register_matches(xt_connbytes_match,
				   ARRAY_SIZE(xt_connbytes_match));
}

static void __exit xt_connbytes_fini(void)
{
	xt_unregister_matches(xt_connbytes_match,
			      ARRAY_SIZE(xt_connbytes_match));
}

module_init(xt_connbytes_init);
module_exit(xt_connbytes_fini);
Commit	Line	Data
9d810fd2 HW	1	/* Kernel module to match connection tracking byte counter.
	2	* GPL (C) 2002 Martin Devera (devik@cdi.cz).
	3	*
	4	* 2004-07-20 Harald Welte <laforge@netfilter.org>
	5	* - reimplemented to use per-connection accounting counters
	6	* - add functionality to match number of packets
	7	* - add functionality to match average packet size
	8	* - add support to match directions seperately
2e4e6a17 HW	9	* 2005-10-16 Harald Welte <laforge@netfilter.org>
2e4e6a17 HW	10	* - Port to x_tables
9d810fd2 HW	11	*
	12	*/
	13	#include <linux/module.h>
	14	#include <linux/skbuff.h>
9fb9cbb1	15	#include <net/netfilter/nf_conntrack_compat.h>
2e4e6a17 HW	16	#include <linux/netfilter/x_tables.h>
2e4e6a17 HW	17	#include <linux/netfilter/xt_connbytes.h>
9d810fd2 HW	18
	19	#include <asm/div64.h>
	20	#include <asm/bitops.h>
	21
	22	MODULE_LICENSE("GPL");
	23	MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
	24	MODULE_DESCRIPTION("iptables match for matching number of pkts/bytes per connection");
2e4e6a17	25	MODULE_ALIAS("ipt_connbytes");
9d810fd2 HW	26
9d810fd2 HW	27	/* 64bit divisor, dividend and result. dynamic precision */
8ffde671	28	static u_int64_t div64_64(u_int64_t dividend, u_int64_t divisor)
9d810fd2	29	{
8ffde671	30	u_int32_t d = divisor;
9d810fd2	31
8ffde671 PM	32	if (divisor > 0xffffffffULL) {
8ffde671 PM	33	unsigned int shift = fls(divisor >> 32);
9d810fd2	34
8ffde671 PM	35	d = divisor >> shift;
	36	dividend >>= shift;
	37	}
9d810fd2	38
8ffde671 PM	39	do_div(dividend, d);
8ffde671 PM	40	return dividend;
9d810fd2 HW	41	}
	42
	43	static int
	44	match(const struct sk_buff *skb,
	45	const struct net_device *in,
	46	const struct net_device *out,
c4986734	47	const struct xt_match *match,
9d810fd2 HW	48	const void *matchinfo,
9d810fd2 HW	49	int offset,
2e4e6a17	50	unsigned int protoff,
9d810fd2 HW	51	int *hotdrop)
9d810fd2 HW	52	{
2e4e6a17	53	const struct xt_connbytes_info *sinfo = matchinfo;
9d810fd2	54	u_int64_t what = 0; /* initialize to make gcc happy */
9fb9cbb1	55	const struct ip_conntrack_counter *counters;
9d810fd2	56
9fb9cbb1	57	if (!(counters = nf_ct_get_counters(skb)))
9d810fd2 HW	58	return 0; /* no match */
	59
	60	switch (sinfo->what) {
2e4e6a17	61	case XT_CONNBYTES_PKTS:
9d810fd2	62	switch (sinfo->direction) {
2e4e6a17	63	case XT_CONNBYTES_DIR_ORIGINAL:
9fb9cbb1	64	what = counters[IP_CT_DIR_ORIGINAL].packets;
9d810fd2	65	break;
2e4e6a17	66	case XT_CONNBYTES_DIR_REPLY:
9fb9cbb1	67	what = counters[IP_CT_DIR_REPLY].packets;
9d810fd2	68	break;
2e4e6a17	69	case XT_CONNBYTES_DIR_BOTH:
9fb9cbb1 YK	70	what = counters[IP_CT_DIR_ORIGINAL].packets;
9fb9cbb1 YK	71	what += counters[IP_CT_DIR_REPLY].packets;
9d810fd2 HW	72	break;
	73	}
	74	break;
2e4e6a17	75	case XT_CONNBYTES_BYTES:
9d810fd2	76	switch (sinfo->direction) {
2e4e6a17	77	case XT_CONNBYTES_DIR_ORIGINAL:
9fb9cbb1	78	what = counters[IP_CT_DIR_ORIGINAL].bytes;
9d810fd2	79	break;
2e4e6a17	80	case XT_CONNBYTES_DIR_REPLY:
9fb9cbb1	81	what = counters[IP_CT_DIR_REPLY].bytes;
9d810fd2	82	break;
2e4e6a17	83	case XT_CONNBYTES_DIR_BOTH:
9fb9cbb1 YK	84	what = counters[IP_CT_DIR_ORIGINAL].bytes;
9fb9cbb1 YK	85	what += counters[IP_CT_DIR_REPLY].bytes;
9d810fd2 HW	86	break;
	87	}
	88	break;
2e4e6a17	89	case XT_CONNBYTES_AVGPKT:
9d810fd2	90	switch (sinfo->direction) {
2e4e6a17	91	case XT_CONNBYTES_DIR_ORIGINAL:
9fb9cbb1 YK	92	what = div64_64(counters[IP_CT_DIR_ORIGINAL].bytes,
9fb9cbb1 YK	93	counters[IP_CT_DIR_ORIGINAL].packets);
9d810fd2	94	break;
2e4e6a17	95	case XT_CONNBYTES_DIR_REPLY:
9fb9cbb1 YK	96	what = div64_64(counters[IP_CT_DIR_REPLY].bytes,
9fb9cbb1 YK	97	counters[IP_CT_DIR_REPLY].packets);
9d810fd2	98	break;
2e4e6a17	99	case XT_CONNBYTES_DIR_BOTH:
9d810fd2 HW	100	{
	101	u_int64_t bytes;
	102	u_int64_t pkts;
9fb9cbb1 YK	103	bytes = counters[IP_CT_DIR_ORIGINAL].bytes +
	104	counters[IP_CT_DIR_REPLY].bytes;
	105	pkts = counters[IP_CT_DIR_ORIGINAL].packets+
	106	counters[IP_CT_DIR_REPLY].packets;
9d810fd2 HW	107
	108	/* FIXME_THEORETICAL: what to do if sum
	109	* overflows ? */
	110
	111	what = div64_64(bytes, pkts);
	112	}
	113	break;
	114	}
	115	break;
	116	}
	117
	118	if (sinfo->count.to)
	119	return (what <= sinfo->count.to && what >= sinfo->count.from);
	120	else
	121	return (what >= sinfo->count.from);
	122	}
	123
	124	static int check(const char *tablename,
2e4e6a17	125	const void *ip,
c4986734	126	const struct xt_match *match,
9d810fd2	127	void *matchinfo,
9d810fd2 HW	128	unsigned int hook_mask)
9d810fd2 HW	129	{
2e4e6a17	130	const struct xt_connbytes_info *sinfo = matchinfo;
9d810fd2	131
2e4e6a17 HW	132	if (sinfo->what != XT_CONNBYTES_PKTS &&
	133	sinfo->what != XT_CONNBYTES_BYTES &&
	134	sinfo->what != XT_CONNBYTES_AVGPKT)
9d810fd2 HW	135	return 0;
9d810fd2 HW	136
2e4e6a17 HW	137	if (sinfo->direction != XT_CONNBYTES_DIR_ORIGINAL &&
	138	sinfo->direction != XT_CONNBYTES_DIR_REPLY &&
	139	sinfo->direction != XT_CONNBYTES_DIR_BOTH)
9d810fd2 HW	140	return 0;
	141
	142	return 1;
	143	}
	144
fe1cb108	145	static struct xt_match xt_connbytes_match[] = {
4470bbc7 PM	146	{
	147	.name = "connbytes",
	148	.family = AF_INET,
	149	.checkentry = check,
	150	.match = match,
	151	.matchsize = sizeof(struct xt_connbytes_info),
	152	.me = THIS_MODULE
	153	},
	154	{
	155	.name = "connbytes",
	156	.family = AF_INET6,
	157	.checkentry = check,
	158	.match = match,
	159	.matchsize = sizeof(struct xt_connbytes_info),
	160	.me = THIS_MODULE
	161	},
9d810fd2 HW	162	};
9d810fd2 HW	163
65b4b4e8	164	static int __init xt_connbytes_init(void)
9d810fd2	165	{
4470bbc7 PM	166	return xt_register_matches(xt_connbytes_match,
4470bbc7 PM	167	ARRAY_SIZE(xt_connbytes_match));
9d810fd2 HW	168	}
9d810fd2 HW	169
65b4b4e8	170	static void __exit xt_connbytes_fini(void)
9d810fd2	171	{
4470bbc7 PM	172	xt_unregister_matches(xt_connbytes_match,
4470bbc7 PM	173	ARRAY_SIZE(xt_connbytes_match));
9d810fd2 HW	174	}
9d810fd2 HW	175
65b4b4e8 AM	176	module_init(xt_connbytes_init);
65b4b4e8 AM	177	module_exit(xt_connbytes_fini);