err.no Git - linux-2.6/blob - net/netfilter/xt_connbytes.c

   1 /* Kernel module to match connection tracking byte counter.
   2  * GPL (C) 2002 Martin Devera (devik@cdi.cz).
   3  *
   4  * 2004-07-20 Harald Welte <laforge@netfilter.org>
   5  *      - reimplemented to use per-connection accounting counters
   6  *      - add functionality to match number of packets
   7  *      - add functionality to match average packet size
   8  *      - add support to match directions seperately
   9  * 2005-10-16 Harald Welte <laforge@netfilter.org>
  10  *      - Port to x_tables
  11  *
  12  */
  13 #include <linux/module.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/netfilter/x_tables.h>
  16 #include <linux/netfilter/xt_connbytes.h>
  17 #include <net/netfilter/nf_conntrack.h>
  18
  19 #include <asm/div64.h>
  20 #include <asm/bitops.h>
  21
  22 MODULE_LICENSE("GPL");
  23 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
  24 MODULE_DESCRIPTION("iptables match for matching number of pkts/bytes per connection");
  25 MODULE_ALIAS("ipt_connbytes");
  26
  27 static int
  28 match(const struct sk_buff *skb,
  29       const struct net_device *in,
  30       const struct net_device *out,
  31       const struct xt_match *match,
  32       const void *matchinfo,
  33       int offset,
  34       unsigned int protoff,
  35       int *hotdrop)
  36 {
  37         const struct xt_connbytes_info *sinfo = matchinfo;
  38         struct nf_conn *ct;
  39         enum ip_conntrack_info ctinfo;
  40         u_int64_t what = 0;     /* initialize to make gcc happy */
  41         u_int64_t bytes = 0;
  42         u_int64_t pkts = 0;
  43         const struct ip_conntrack_counter *counters;
  44
  45         ct = nf_ct_get(skb, &ctinfo);
  46         if (!ct)
  47                 return 0;
  48         counters = ct->counters;
  49
  50         switch (sinfo->what) {
  51         case XT_CONNBYTES_PKTS:
  52                 switch (sinfo->direction) {
  53                 case XT_CONNBYTES_DIR_ORIGINAL:
  54                         what = counters[IP_CT_DIR_ORIGINAL].packets;
  55                         break;
  56                 case XT_CONNBYTES_DIR_REPLY:
  57                         what = counters[IP_CT_DIR_REPLY].packets;
  58                         break;
  59                 case XT_CONNBYTES_DIR_BOTH:
  60                         what = counters[IP_CT_DIR_ORIGINAL].packets;
  61                         what += counters[IP_CT_DIR_REPLY].packets;
  62                         break;
  63                 }
  64                 break;
  65         case XT_CONNBYTES_BYTES:
  66                 switch (sinfo->direction) {
  67                 case XT_CONNBYTES_DIR_ORIGINAL:
  68                         what = counters[IP_CT_DIR_ORIGINAL].bytes;
  69                         break;
  70                 case XT_CONNBYTES_DIR_REPLY:
  71                         what = counters[IP_CT_DIR_REPLY].bytes;
  72                         break;
  73                 case XT_CONNBYTES_DIR_BOTH:
  74                         what = counters[IP_CT_DIR_ORIGINAL].bytes;
  75                         what += counters[IP_CT_DIR_REPLY].bytes;
  76                         break;
  77                 }
  78                 break;
  79         case XT_CONNBYTES_AVGPKT:
  80                 switch (sinfo->direction) {
  81                 case XT_CONNBYTES_DIR_ORIGINAL:
  82                         bytes = counters[IP_CT_DIR_ORIGINAL].bytes;
  83                         pkts  = counters[IP_CT_DIR_ORIGINAL].packets;
  84                         break;
  85                 case XT_CONNBYTES_DIR_REPLY:
  86                         bytes = counters[IP_CT_DIR_REPLY].bytes;
  87                         pkts  = counters[IP_CT_DIR_REPLY].packets;
  88                         break;
  89                 case XT_CONNBYTES_DIR_BOTH:
  90                         bytes = counters[IP_CT_DIR_ORIGINAL].bytes +
  91                                 counters[IP_CT_DIR_REPLY].bytes;
  92                         pkts  = counters[IP_CT_DIR_ORIGINAL].packets +
  93                                 counters[IP_CT_DIR_REPLY].packets;
  94                         break;
  95                 }
  96                 if (pkts != 0)
  97                         what = div64_64(bytes, pkts);
  98                 break;
  99         }
 100
 101         if (sinfo->count.to)
 102                 return (what <= sinfo->count.to && what >= sinfo->count.from);
 103         else
 104                 return (what >= sinfo->count.from);
 105 }
 106
 107 static int check(const char *tablename,
 108                  const void *ip,
 109                  const struct xt_match *match,
 110                  void *matchinfo,
 111                  unsigned int hook_mask)
 112 {
 113         const struct xt_connbytes_info *sinfo = matchinfo;
 114
 115         if (sinfo->what != XT_CONNBYTES_PKTS &&
 116             sinfo->what != XT_CONNBYTES_BYTES &&
 117             sinfo->what != XT_CONNBYTES_AVGPKT)
 118                 return 0;
 119
 120         if (sinfo->direction != XT_CONNBYTES_DIR_ORIGINAL &&
 121             sinfo->direction != XT_CONNBYTES_DIR_REPLY &&
 122             sinfo->direction != XT_CONNBYTES_DIR_BOTH)
 123                 return 0;
 124
 125         if (nf_ct_l3proto_try_module_get(match->family) < 0) {
 126                 printk(KERN_WARNING "can't load conntrack support for "
 127                                     "proto=%d\n", match->family);
 128                 return 0;
 129         }
 130
 131         return 1;
 132 }
 133
 134 static void
 135 destroy(const struct xt_match *match, void *matchinfo)
 136 {
 137         nf_ct_l3proto_module_put(match->family);
 138 }
 139
 140 static struct xt_match xt_connbytes_match[] = {
 141         {
 142                 .name           = "connbytes",
 143                 .family         = AF_INET,
 144                 .checkentry     = check,
 145                 .match          = match,
 146                 .destroy        = destroy,
 147                 .matchsize      = sizeof(struct xt_connbytes_info),
 148                 .me             = THIS_MODULE
 149         },
 150         {
 151                 .name           = "connbytes",
 152                 .family         = AF_INET6,
 153                 .checkentry     = check,
 154                 .match          = match,
 155                 .destroy        = destroy,
 156                 .matchsize      = sizeof(struct xt_connbytes_info),
 157                 .me             = THIS_MODULE
 158         },
 159 };
 160
 161 static int __init xt_connbytes_init(void)
 162 {
 163         return xt_register_matches(xt_connbytes_match,
 164                                    ARRAY_SIZE(xt_connbytes_match));
 165 }
 166
 167 static void __exit xt_connbytes_fini(void)
 168 {
 169         xt_unregister_matches(xt_connbytes_match,
 170                               ARRAY_SIZE(xt_connbytes_match));
 171 }
 172
 173 module_init(xt_connbytes_init);
 174 module_exit(xt_connbytes_fini);