ARM: 7409/1: Do not call flush_cache_user_range with mmap_sem held
[linux/fpc-iii.git] / net / netfilter / xt_connbytes.c
blob5b138506690ec578105911ffb64309b5297d6458
1 /* Kernel module to match connection tracking byte counter.
2 * GPL (C) 2002 Martin Devera (devik@cdi.cz).
3 */
4 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
5 #include <linux/module.h>
6 #include <linux/bitops.h>
7 #include <linux/skbuff.h>
8 #include <linux/math64.h>
9 #include <linux/netfilter/x_tables.h>
10 #include <linux/netfilter/xt_connbytes.h>
11 #include <net/netfilter/nf_conntrack.h>
12 #include <net/netfilter/nf_conntrack_acct.h>
14 MODULE_LICENSE("GPL");
15 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
16 MODULE_DESCRIPTION("Xtables: Number of packets/bytes per connection matching");
17 MODULE_ALIAS("ipt_connbytes");
18 MODULE_ALIAS("ip6t_connbytes");
20 static bool
21 connbytes_mt(const struct sk_buff *skb, struct xt_action_param *par)
23 const struct xt_connbytes_info *sinfo = par->matchinfo;
24 const struct nf_conn *ct;
25 enum ip_conntrack_info ctinfo;
26 u_int64_t what = 0; /* initialize to make gcc happy */
27 u_int64_t bytes = 0;
28 u_int64_t pkts = 0;
29 const struct nf_conn_counter *counters;
31 ct = nf_ct_get(skb, &ctinfo);
32 if (!ct)
33 return false;
35 counters = nf_conn_acct_find(ct);
36 if (!counters)
37 return false;
39 switch (sinfo->what) {
40 case XT_CONNBYTES_PKTS:
41 switch (sinfo->direction) {
42 case XT_CONNBYTES_DIR_ORIGINAL:
43 what = counters[IP_CT_DIR_ORIGINAL].packets;
44 break;
45 case XT_CONNBYTES_DIR_REPLY:
46 what = counters[IP_CT_DIR_REPLY].packets;
47 break;
48 case XT_CONNBYTES_DIR_BOTH:
49 what = counters[IP_CT_DIR_ORIGINAL].packets;
50 what += counters[IP_CT_DIR_REPLY].packets;
51 break;
53 break;
54 case XT_CONNBYTES_BYTES:
55 switch (sinfo->direction) {
56 case XT_CONNBYTES_DIR_ORIGINAL:
57 what = counters[IP_CT_DIR_ORIGINAL].bytes;
58 break;
59 case XT_CONNBYTES_DIR_REPLY:
60 what = counters[IP_CT_DIR_REPLY].bytes;
61 break;
62 case XT_CONNBYTES_DIR_BOTH:
63 what = counters[IP_CT_DIR_ORIGINAL].bytes;
64 what += counters[IP_CT_DIR_REPLY].bytes;
65 break;
67 break;
68 case XT_CONNBYTES_AVGPKT:
69 switch (sinfo->direction) {
70 case XT_CONNBYTES_DIR_ORIGINAL:
71 bytes = counters[IP_CT_DIR_ORIGINAL].bytes;
72 pkts = counters[IP_CT_DIR_ORIGINAL].packets;
73 break;
74 case XT_CONNBYTES_DIR_REPLY:
75 bytes = counters[IP_CT_DIR_REPLY].bytes;
76 pkts = counters[IP_CT_DIR_REPLY].packets;
77 break;
78 case XT_CONNBYTES_DIR_BOTH:
79 bytes = counters[IP_CT_DIR_ORIGINAL].bytes +
80 counters[IP_CT_DIR_REPLY].bytes;
81 pkts = counters[IP_CT_DIR_ORIGINAL].packets +
82 counters[IP_CT_DIR_REPLY].packets;
83 break;
85 if (pkts != 0)
86 what = div64_u64(bytes, pkts);
87 break;
90 if (sinfo->count.to)
91 return what <= sinfo->count.to && what >= sinfo->count.from;
92 else
93 return what >= sinfo->count.from;
96 static int connbytes_mt_check(const struct xt_mtchk_param *par)
98 const struct xt_connbytes_info *sinfo = par->matchinfo;
99 int ret;
101 if (sinfo->what != XT_CONNBYTES_PKTS &&
102 sinfo->what != XT_CONNBYTES_BYTES &&
103 sinfo->what != XT_CONNBYTES_AVGPKT)
104 return -EINVAL;
106 if (sinfo->direction != XT_CONNBYTES_DIR_ORIGINAL &&
107 sinfo->direction != XT_CONNBYTES_DIR_REPLY &&
108 sinfo->direction != XT_CONNBYTES_DIR_BOTH)
109 return -EINVAL;
111 ret = nf_ct_l3proto_try_module_get(par->family);
112 if (ret < 0)
113 pr_info("cannot load conntrack support for proto=%u\n",
114 par->family);
117 * This filter cannot function correctly unless connection tracking
118 * accounting is enabled, so complain in the hope that someone notices.
120 if (!nf_ct_acct_enabled(par->net)) {
121 pr_warning("Forcing CT accounting to be enabled\n");
122 nf_ct_set_acct(par->net, true);
125 return ret;
128 static void connbytes_mt_destroy(const struct xt_mtdtor_param *par)
130 nf_ct_l3proto_module_put(par->family);
133 static struct xt_match connbytes_mt_reg __read_mostly = {
134 .name = "connbytes",
135 .revision = 0,
136 .family = NFPROTO_UNSPEC,
137 .checkentry = connbytes_mt_check,
138 .match = connbytes_mt,
139 .destroy = connbytes_mt_destroy,
140 .matchsize = sizeof(struct xt_connbytes_info),
141 .me = THIS_MODULE,
144 static int __init connbytes_mt_init(void)
146 return xt_register_match(&connbytes_mt_reg);
149 static void __exit connbytes_mt_exit(void)
151 xt_unregister_match(&connbytes_mt_reg);
154 module_init(connbytes_mt_init);
155 module_exit(connbytes_mt_exit);