[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / netfilter / xt_connbytes.c

/* Kernel module to match connection tracking byte counter.
 * GPL (C) 2002 Martin Devera (devik@cdi.cz).
 */
#include <linux/module.h>
#include <linux/bitops.h>
#include <linux/skbuff.h>
#include <linux/math64.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_connbytes.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_acct.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("Xtables: Number of packets/bytes per connection matching");
MODULE_ALIAS("ipt_connbytes");
MODULE_ALIAS("ip6t_connbytes");

static bool
connbytes_mt(const struct sk_buff *skb, const struct xt_match_param *par)
{
	const struct xt_connbytes_info *sinfo = par->matchinfo;
	const struct nf_conn *ct;
	enum ip_conntrack_info ctinfo;
	u_int64_t what = 0;	/* initialize to make gcc happy */
	u_int64_t bytes = 0;
	u_int64_t pkts = 0;
	const struct nf_conn_counter *counters;

	ct = nf_ct_get(skb, &ctinfo);
	if (!ct)
		return false;

	counters = nf_conn_acct_find(ct);
	if (!counters)
		return false;

	switch (sinfo->what) {
	case XT_CONNBYTES_PKTS:
		switch (sinfo->direction) {
		case XT_CONNBYTES_DIR_ORIGINAL:
			what = counters[IP_CT_DIR_ORIGINAL].packets;
			break;
		case XT_CONNBYTES_DIR_REPLY:
			what = counters[IP_CT_DIR_REPLY].packets;
			break;
		case XT_CONNBYTES_DIR_BOTH:
			what = counters[IP_CT_DIR_ORIGINAL].packets;
			what += counters[IP_CT_DIR_REPLY].packets;
			break;
		}
		break;
	case XT_CONNBYTES_BYTES:
		switch (sinfo->direction) {
		case XT_CONNBYTES_DIR_ORIGINAL:
			what = counters[IP_CT_DIR_ORIGINAL].bytes;
			break;
		case XT_CONNBYTES_DIR_REPLY:
			what = counters[IP_CT_DIR_REPLY].bytes;
			break;
		case XT_CONNBYTES_DIR_BOTH:
			what = counters[IP_CT_DIR_ORIGINAL].bytes;
			what += counters[IP_CT_DIR_REPLY].bytes;
			break;
		}
		break;
	case XT_CONNBYTES_AVGPKT:
		switch (sinfo->direction) {
		case XT_CONNBYTES_DIR_ORIGINAL:
			bytes = counters[IP_CT_DIR_ORIGINAL].bytes;
			pkts  = counters[IP_CT_DIR_ORIGINAL].packets;
			break;
		case XT_CONNBYTES_DIR_REPLY:
			bytes = counters[IP_CT_DIR_REPLY].bytes;
			pkts  = counters[IP_CT_DIR_REPLY].packets;
			break;
		case XT_CONNBYTES_DIR_BOTH:
			bytes = counters[IP_CT_DIR_ORIGINAL].bytes +
				counters[IP_CT_DIR_REPLY].bytes;
			pkts  = counters[IP_CT_DIR_ORIGINAL].packets +
				counters[IP_CT_DIR_REPLY].packets;
			break;
		}
		if (pkts != 0)
			what = div64_u64(bytes, pkts);
		break;
	}

	if (sinfo->count.to)
		return what <= sinfo->count.to && what >= sinfo->count.from;
	else
		return what >= sinfo->count.from;
}

static bool connbytes_mt_check(const struct xt_mtchk_param *par)
{
	const struct xt_connbytes_info *sinfo = par->matchinfo;

	if (sinfo->what != XT_CONNBYTES_PKTS &&
	    sinfo->what != XT_CONNBYTES_BYTES &&
	    sinfo->what != XT_CONNBYTES_AVGPKT)
		return false;

	if (sinfo->direction != XT_CONNBYTES_DIR_ORIGINAL &&
	    sinfo->direction != XT_CONNBYTES_DIR_REPLY &&
	    sinfo->direction != XT_CONNBYTES_DIR_BOTH)
		return false;

	if (nf_ct_l3proto_try_module_get(par->family) < 0) {
		printk(KERN_WARNING "can't load conntrack support for "
				    "proto=%u\n", par->family);
		return false;
	}

	return true;
}

static void connbytes_mt_destroy(const struct xt_mtdtor_param *par)
{
	nf_ct_l3proto_module_put(par->family);
}

static struct xt_match connbytes_mt_reg __read_mostly = {
	.name       = "connbytes",
	.revision   = 0,
	.family     = NFPROTO_UNSPEC,
	.checkentry = connbytes_mt_check,
	.match      = connbytes_mt,
	.destroy    = connbytes_mt_destroy,
	.matchsize  = sizeof(struct xt_connbytes_info),
	.me         = THIS_MODULE,
};

static int __init connbytes_mt_init(void)
{
	return xt_register_match(&connbytes_mt_reg);
}

static void __exit connbytes_mt_exit(void)
{
	xt_unregister_match(&connbytes_mt_reg);
}

module_init(connbytes_mt_init);
module_exit(connbytes_mt_exit);
Commit	Line	Data
9d810fd2 HW	1	/* Kernel module to match connection tracking byte counter.
9d810fd2 HW	2	* GPL (C) 2002 Martin Devera (devik@cdi.cz).
9d810fd2 HW	3	*/
9d810fd2 HW	4	#include <linux/module.h>
1977f032	5	#include <linux/bitops.h>
9d810fd2	6	#include <linux/skbuff.h>
6f6d6a1a	7	#include <linux/math64.h>
2e4e6a17 HW	8	#include <linux/netfilter/x_tables.h>
2e4e6a17 HW	9	#include <linux/netfilter/xt_connbytes.h>
587aa641	10	#include <net/netfilter/nf_conntrack.h>
58401572	11	#include <net/netfilter/nf_conntrack_acct.h>
9d810fd2	12
9d810fd2 HW	13	MODULE_LICENSE("GPL");
9d810fd2 HW	14	MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
2ae15b64	15	MODULE_DESCRIPTION("Xtables: Number of packets/bytes per connection matching");
2e4e6a17	16	MODULE_ALIAS("ipt_connbytes");
73aaf935	17	MODULE_ALIAS("ip6t_connbytes");
9d810fd2	18
1d93a9cb	19	static bool
f7108a20	20	connbytes_mt(const struct sk_buff skb, const struct xt_match_param par)
9d810fd2	21	{
f7108a20	22	const struct xt_connbytes_info *sinfo = par->matchinfo;
a47362a2	23	const struct nf_conn *ct;
587aa641	24	enum ip_conntrack_info ctinfo;
9d810fd2	25	u_int64_t what = 0; /* initialize to make gcc happy */
fb74a841 PM	26	u_int64_t bytes = 0;
fb74a841 PM	27	u_int64_t pkts = 0;
58401572	28	const struct nf_conn_counter *counters;
9d810fd2	29
587aa641 PM	30	ct = nf_ct_get(skb, &ctinfo);
587aa641 PM	31	if (!ct)
1d93a9cb	32	return false;
58401572 KPO	33
	34	counters = nf_conn_acct_find(ct);
	35	if (!counters)
	36	return false;
9d810fd2 HW	37
9d810fd2 HW	38	switch (sinfo->what) {
2e4e6a17	39	case XT_CONNBYTES_PKTS:
9d810fd2	40	switch (sinfo->direction) {
2e4e6a17	41	case XT_CONNBYTES_DIR_ORIGINAL:
9fb9cbb1	42	what = counters[IP_CT_DIR_ORIGINAL].packets;
9d810fd2	43	break;
2e4e6a17	44	case XT_CONNBYTES_DIR_REPLY:
9fb9cbb1	45	what = counters[IP_CT_DIR_REPLY].packets;
9d810fd2	46	break;
2e4e6a17	47	case XT_CONNBYTES_DIR_BOTH:
9fb9cbb1 YK	48	what = counters[IP_CT_DIR_ORIGINAL].packets;
9fb9cbb1 YK	49	what += counters[IP_CT_DIR_REPLY].packets;
9d810fd2 HW	50	break;
	51	}
	52	break;
2e4e6a17	53	case XT_CONNBYTES_BYTES:
9d810fd2	54	switch (sinfo->direction) {
2e4e6a17	55	case XT_CONNBYTES_DIR_ORIGINAL:
9fb9cbb1	56	what = counters[IP_CT_DIR_ORIGINAL].bytes;
9d810fd2	57	break;
2e4e6a17	58	case XT_CONNBYTES_DIR_REPLY:
9fb9cbb1	59	what = counters[IP_CT_DIR_REPLY].bytes;
9d810fd2	60	break;
2e4e6a17	61	case XT_CONNBYTES_DIR_BOTH:
9fb9cbb1 YK	62	what = counters[IP_CT_DIR_ORIGINAL].bytes;
9fb9cbb1 YK	63	what += counters[IP_CT_DIR_REPLY].bytes;
9d810fd2 HW	64	break;
	65	}
	66	break;
2e4e6a17	67	case XT_CONNBYTES_AVGPKT:
9d810fd2	68	switch (sinfo->direction) {
2e4e6a17	69	case XT_CONNBYTES_DIR_ORIGINAL:
fb74a841 PM	70	bytes = counters[IP_CT_DIR_ORIGINAL].bytes;
fb74a841 PM	71	pkts = counters[IP_CT_DIR_ORIGINAL].packets;
9d810fd2	72	break;
2e4e6a17	73	case XT_CONNBYTES_DIR_REPLY:
fb74a841 PM	74	bytes = counters[IP_CT_DIR_REPLY].bytes;
fb74a841 PM	75	pkts = counters[IP_CT_DIR_REPLY].packets;
9d810fd2	76	break;
2e4e6a17	77	case XT_CONNBYTES_DIR_BOTH:
fb74a841 PM	78	bytes = counters[IP_CT_DIR_ORIGINAL].bytes +
	79	counters[IP_CT_DIR_REPLY].bytes;
	80	pkts = counters[IP_CT_DIR_ORIGINAL].packets +
	81	counters[IP_CT_DIR_REPLY].packets;
9d810fd2 HW	82	break;
9d810fd2 HW	83	}
fb74a841	84	if (pkts != 0)
6f6d6a1a	85	what = div64_u64(bytes, pkts);
9d810fd2 HW	86	break;
	87	}
	88
	89	if (sinfo->count.to)
7c4e36bc	90	return what <= sinfo->count.to && what >= sinfo->count.from;
9d810fd2	91	else
7c4e36bc	92	return what >= sinfo->count.from;
9d810fd2 HW	93	}
9d810fd2 HW	94
9b4fce7a	95	static bool connbytes_mt_check(const struct xt_mtchk_param *par)
9d810fd2	96	{
9b4fce7a	97	const struct xt_connbytes_info *sinfo = par->matchinfo;
9d810fd2	98
2e4e6a17 HW	99	if (sinfo->what != XT_CONNBYTES_PKTS &&
	100	sinfo->what != XT_CONNBYTES_BYTES &&
	101	sinfo->what != XT_CONNBYTES_AVGPKT)
ccb79bdc	102	return false;
9d810fd2	103
2e4e6a17 HW	104	if (sinfo->direction != XT_CONNBYTES_DIR_ORIGINAL &&
	105	sinfo->direction != XT_CONNBYTES_DIR_REPLY &&
	106	sinfo->direction != XT_CONNBYTES_DIR_BOTH)
ccb79bdc	107	return false;
9d810fd2	108
92f3b2b1	109	if (nf_ct_l3proto_try_module_get(par->family) < 0) {
11078c37	110	printk(KERN_WARNING "can't load conntrack support for "
92f3b2b1	111	"proto=%u\n", par->family);
ccb79bdc	112	return false;
11078c37 YK	113	}
11078c37 YK	114
ccb79bdc	115	return true;
9d810fd2 HW	116	}
9d810fd2 HW	117
6be3d859	118	static void connbytes_mt_destroy(const struct xt_mtdtor_param *par)
11078c37	119	{
92f3b2b1	120	nf_ct_l3proto_module_put(par->family);
11078c37 YK	121	}
11078c37 YK	122
92f3b2b1 JE	123	static struct xt_match connbytes_mt_reg __read_mostly = {
	124	.name = "connbytes",
	125	.revision = 0,
	126	.family = NFPROTO_UNSPEC,
	127	.checkentry = connbytes_mt_check,
	128	.match = connbytes_mt,
	129	.destroy = connbytes_mt_destroy,
	130	.matchsize = sizeof(struct xt_connbytes_info),
	131	.me = THIS_MODULE,
9d810fd2 HW	132	};
9d810fd2 HW	133
d3c5ee6d	134	static int __init connbytes_mt_init(void)
9d810fd2	135	{
92f3b2b1	136	return xt_register_match(&connbytes_mt_reg);
9d810fd2 HW	137	}
9d810fd2 HW	138
d3c5ee6d	139	static void __exit connbytes_mt_exit(void)
9d810fd2	140	{
92f3b2b1	141	xt_unregister_match(&connbytes_mt_reg);
9d810fd2 HW	142	}
9d810fd2 HW	143
d3c5ee6d JE	144	module_init(connbytes_mt_init);
d3c5ee6d JE	145	module_exit(connbytes_mt_exit);