[NETFILTER]: Remove IPv4 only connection tracking/NAT
[linux-2.6.git] / net / netfilter / xt_connbytes.c
1 /* Kernel module to match connection tracking byte counter.
2  * GPL (C) 2002 Martin Devera (devik@cdi.cz).
3  *
4  * 2004-07-20 Harald Welte <laforge@netfilter.org>
5  *      - reimplemented to use per-connection accounting counters
6  *      - add functionality to match number of packets
7  *      - add functionality to match average packet size
8  *      - add support to match directions seperately
9  * 2005-10-16 Harald Welte <laforge@netfilter.org>
10  *      - Port to x_tables
11  *
12  */
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
15 #include <linux/netfilter/x_tables.h>
16 #include <linux/netfilter/xt_connbytes.h>
17 #include <net/netfilter/nf_conntrack.h>
18
19 #include <asm/div64.h>
20 #include <asm/bitops.h>
21
22 MODULE_LICENSE("GPL");
23 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
24 MODULE_DESCRIPTION("iptables match for matching number of pkts/bytes per connection");
25 MODULE_ALIAS("ipt_connbytes");
26
27 static int
28 match(const struct sk_buff *skb,
29       const struct net_device *in,
30       const struct net_device *out,
31       const struct xt_match *match,
32       const void *matchinfo,
33       int offset,
34       unsigned int protoff,
35       int *hotdrop)
36 {
37         const struct xt_connbytes_info *sinfo = matchinfo;
38         struct nf_conn *ct;
39         enum ip_conntrack_info ctinfo;
40         u_int64_t what = 0;     /* initialize to make gcc happy */
41         u_int64_t bytes = 0;
42         u_int64_t pkts = 0;
43         const struct ip_conntrack_counter *counters;
44
45         ct = nf_ct_get(skb, &ctinfo);
46         if (!ct)
47                 return 0;
48         counters = ct->counters;
49
50         switch (sinfo->what) {
51         case XT_CONNBYTES_PKTS:
52                 switch (sinfo->direction) {
53                 case XT_CONNBYTES_DIR_ORIGINAL:
54                         what = counters[IP_CT_DIR_ORIGINAL].packets;
55                         break;
56                 case XT_CONNBYTES_DIR_REPLY:
57                         what = counters[IP_CT_DIR_REPLY].packets;
58                         break;
59                 case XT_CONNBYTES_DIR_BOTH:
60                         what = counters[IP_CT_DIR_ORIGINAL].packets;
61                         what += counters[IP_CT_DIR_REPLY].packets;
62                         break;
63                 }
64                 break;
65         case XT_CONNBYTES_BYTES:
66                 switch (sinfo->direction) {
67                 case XT_CONNBYTES_DIR_ORIGINAL:
68                         what = counters[IP_CT_DIR_ORIGINAL].bytes;
69                         break;
70                 case XT_CONNBYTES_DIR_REPLY:
71                         what = counters[IP_CT_DIR_REPLY].bytes;
72                         break;
73                 case XT_CONNBYTES_DIR_BOTH:
74                         what = counters[IP_CT_DIR_ORIGINAL].bytes;
75                         what += counters[IP_CT_DIR_REPLY].bytes;
76                         break;
77                 }
78                 break;
79         case XT_CONNBYTES_AVGPKT:
80                 switch (sinfo->direction) {
81                 case XT_CONNBYTES_DIR_ORIGINAL:
82                         bytes = counters[IP_CT_DIR_ORIGINAL].bytes;
83                         pkts  = counters[IP_CT_DIR_ORIGINAL].packets;
84                         break;
85                 case XT_CONNBYTES_DIR_REPLY:
86                         bytes = counters[IP_CT_DIR_REPLY].bytes;
87                         pkts  = counters[IP_CT_DIR_REPLY].packets;
88                         break;
89                 case XT_CONNBYTES_DIR_BOTH:
90                         bytes = counters[IP_CT_DIR_ORIGINAL].bytes +
91                                 counters[IP_CT_DIR_REPLY].bytes;
92                         pkts  = counters[IP_CT_DIR_ORIGINAL].packets +
93                                 counters[IP_CT_DIR_REPLY].packets;
94                         break;
95                 }
96                 if (pkts != 0)
97                         what = div64_64(bytes, pkts);
98                 break;
99         }
100
101         if (sinfo->count.to)
102                 return (what <= sinfo->count.to && what >= sinfo->count.from);
103         else
104                 return (what >= sinfo->count.from);
105 }
106
107 static int check(const char *tablename,
108                  const void *ip,
109                  const struct xt_match *match,
110                  void *matchinfo,
111                  unsigned int hook_mask)
112 {
113         const struct xt_connbytes_info *sinfo = matchinfo;
114
115         if (sinfo->what != XT_CONNBYTES_PKTS &&
116             sinfo->what != XT_CONNBYTES_BYTES &&
117             sinfo->what != XT_CONNBYTES_AVGPKT)
118                 return 0;
119
120         if (sinfo->direction != XT_CONNBYTES_DIR_ORIGINAL &&
121             sinfo->direction != XT_CONNBYTES_DIR_REPLY &&
122             sinfo->direction != XT_CONNBYTES_DIR_BOTH)
123                 return 0;
124
125         if (nf_ct_l3proto_try_module_get(match->family) < 0) {
126                 printk(KERN_WARNING "can't load conntrack support for "
127                                     "proto=%d\n", match->family);
128                 return 0;
129         }
130
131         return 1;
132 }
133
134 static void
135 destroy(const struct xt_match *match, void *matchinfo)
136 {
137         nf_ct_l3proto_module_put(match->family);
138 }
139
140 static struct xt_match xt_connbytes_match[] = {
141         {
142                 .name           = "connbytes",
143                 .family         = AF_INET,
144                 .checkentry     = check,
145                 .match          = match,
146                 .destroy        = destroy,
147                 .matchsize      = sizeof(struct xt_connbytes_info),
148                 .me             = THIS_MODULE
149         },
150         {
151                 .name           = "connbytes",
152                 .family         = AF_INET6,
153                 .checkentry     = check,
154                 .match          = match,
155                 .destroy        = destroy,
156                 .matchsize      = sizeof(struct xt_connbytes_info),
157                 .me             = THIS_MODULE
158         },
159 };
160
161 static int __init xt_connbytes_init(void)
162 {
163         return xt_register_matches(xt_connbytes_match,
164                                    ARRAY_SIZE(xt_connbytes_match));
165 }
166
167 static void __exit xt_connbytes_fini(void)
168 {
169         xt_unregister_matches(xt_connbytes_match,
170                               ARRAY_SIZE(xt_connbytes_match));
171 }
172
173 module_init(xt_connbytes_init);
174 module_exit(xt_connbytes_fini);