2005-08-13 22:56:26 +02:00
|
|
|
/* Kernel module to match connection tracking byte counter.
|
|
|
|
* GPL (C) 2002 Martin Devera (devik@cdi.cz).
|
|
|
|
*/
|
2010-03-17 16:04:40 +01:00
|
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
2005-08-13 22:56:26 +02:00
|
|
|
#include <linux/module.h>
|
2007-10-19 08:40:25 +02:00
|
|
|
#include <linux/bitops.h>
|
2005-08-13 22:56:26 +02:00
|
|
|
#include <linux/skbuff.h>
|
2008-05-01 13:34:28 +02:00
|
|
|
#include <linux/math64.h>
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
#include <linux/netfilter/x_tables.h>
|
|
|
|
#include <linux/netfilter/xt_connbytes.h>
|
2007-03-15 00:37:25 +01:00
|
|
|
#include <net/netfilter/nf_conntrack.h>
|
netfilter: accounting rework: ct_extend + 64bit counters (v4)
Initially netfilter has had 64bit counters for conntrack-based accounting, but
it was changed in 2.6.14 to save memory. Unfortunately in-kernel 64bit counters are
still required, for example for "connbytes" extension. However, 64bit counters
waste a lot of memory and it was not possible to enable/disable it runtime.
This patch:
- reimplements accounting with respect to the extension infrastructure,
- makes one global version of seq_print_acct() instead of two seq_print_counters(),
- makes it possible to enable it at boot time (for CONFIG_SYSCTL/CONFIG_SYSFS=n),
- makes it possible to enable/disable it at runtime by sysctl or sysfs,
- extends counters from 32bit to 64bit,
- renames ip_conntrack_counter -> nf_conn_counter,
- enables accounting code unconditionally (no longer depends on CONFIG_NF_CT_ACCT),
- set initial accounting enable state based on CONFIG_NF_CT_ACCT
- removes buggy IPCT_COUNTER_FILLING event handling.
If accounting is enabled newly created connections get additional acct extend.
Old connections are not changed as it is not possible to add a ct_extend area
to confirmed conntrack. Accounting is performed for all connections with
acct extend regardless of a current state of "net.netfilter.nf_conntrack_acct".
Signed-off-by: Krzysztof Piotr Oledzki <ole@ans.pl>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-21 19:01:34 +02:00
|
|
|
#include <net/netfilter/nf_conntrack_acct.h>
|
2005-08-13 22:56:26 +02:00
|
|
|
|
|
|
|
MODULE_LICENSE("GPL");
|
|
|
|
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
|
2008-01-15 08:42:28 +01:00
|
|
|
MODULE_DESCRIPTION("Xtables: Number of packets/bytes per connection matching");
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
MODULE_ALIAS("ipt_connbytes");
|
2007-10-11 23:36:40 +02:00
|
|
|
MODULE_ALIAS("ip6t_connbytes");
|
2005-08-13 22:56:26 +02:00
|
|
|
|
2007-07-08 07:15:35 +02:00
|
|
|
static bool
|
2009-07-07 20:42:08 +02:00
|
|
|
connbytes_mt(const struct sk_buff *skb, struct xt_action_param *par)
|
2005-08-13 22:56:26 +02:00
|
|
|
{
|
2008-10-08 11:35:18 +02:00
|
|
|
const struct xt_connbytes_info *sinfo = par->matchinfo;
|
2007-07-08 07:16:55 +02:00
|
|
|
const struct nf_conn *ct;
|
2007-03-15 00:37:25 +01:00
|
|
|
enum ip_conntrack_info ctinfo;
|
2005-08-13 22:56:26 +02:00
|
|
|
u_int64_t what = 0; /* initialize to make gcc happy */
|
2007-01-30 23:24:29 +01:00
|
|
|
u_int64_t bytes = 0;
|
|
|
|
u_int64_t pkts = 0;
|
2013-09-26 17:31:51 +02:00
|
|
|
const struct nf_conn_acct *acct;
|
netfilter: accounting rework: ct_extend + 64bit counters (v4)
Initially netfilter has had 64bit counters for conntrack-based accounting, but
it was changed in 2.6.14 to save memory. Unfortunately in-kernel 64bit counters are
still required, for example for "connbytes" extension. However, 64bit counters
waste a lot of memory and it was not possible to enable/disable it runtime.
This patch:
- reimplements accounting with respect to the extension infrastructure,
- makes one global version of seq_print_acct() instead of two seq_print_counters(),
- makes it possible to enable it at boot time (for CONFIG_SYSCTL/CONFIG_SYSFS=n),
- makes it possible to enable/disable it at runtime by sysctl or sysfs,
- extends counters from 32bit to 64bit,
- renames ip_conntrack_counter -> nf_conn_counter,
- enables accounting code unconditionally (no longer depends on CONFIG_NF_CT_ACCT),
- set initial accounting enable state based on CONFIG_NF_CT_ACCT
- removes buggy IPCT_COUNTER_FILLING event handling.
If accounting is enabled newly created connections get additional acct extend.
Old connections are not changed as it is not possible to add a ct_extend area
to confirmed conntrack. Accounting is performed for all connections with
acct extend regardless of a current state of "net.netfilter.nf_conntrack_acct".
Signed-off-by: Krzysztof Piotr Oledzki <ole@ans.pl>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-21 19:01:34 +02:00
|
|
|
const struct nf_conn_counter *counters;
|
2005-08-13 22:56:26 +02:00
|
|
|
|
2007-03-15 00:37:25 +01:00
|
|
|
ct = nf_ct_get(skb, &ctinfo);
|
|
|
|
if (!ct)
|
2007-07-08 07:15:35 +02:00
|
|
|
return false;
|
netfilter: accounting rework: ct_extend + 64bit counters (v4)
Initially netfilter has had 64bit counters for conntrack-based accounting, but
it was changed in 2.6.14 to save memory. Unfortunately in-kernel 64bit counters are
still required, for example for "connbytes" extension. However, 64bit counters
waste a lot of memory and it was not possible to enable/disable it runtime.
This patch:
- reimplements accounting with respect to the extension infrastructure,
- makes one global version of seq_print_acct() instead of two seq_print_counters(),
- makes it possible to enable it at boot time (for CONFIG_SYSCTL/CONFIG_SYSFS=n),
- makes it possible to enable/disable it at runtime by sysctl or sysfs,
- extends counters from 32bit to 64bit,
- renames ip_conntrack_counter -> nf_conn_counter,
- enables accounting code unconditionally (no longer depends on CONFIG_NF_CT_ACCT),
- set initial accounting enable state based on CONFIG_NF_CT_ACCT
- removes buggy IPCT_COUNTER_FILLING event handling.
If accounting is enabled newly created connections get additional acct extend.
Old connections are not changed as it is not possible to add a ct_extend area
to confirmed conntrack. Accounting is performed for all connections with
acct extend regardless of a current state of "net.netfilter.nf_conntrack_acct".
Signed-off-by: Krzysztof Piotr Oledzki <ole@ans.pl>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-21 19:01:34 +02:00
|
|
|
|
2013-09-26 17:31:51 +02:00
|
|
|
acct = nf_conn_acct_find(ct);
|
|
|
|
if (!acct)
|
netfilter: accounting rework: ct_extend + 64bit counters (v4)
Initially netfilter has had 64bit counters for conntrack-based accounting, but
it was changed in 2.6.14 to save memory. Unfortunately in-kernel 64bit counters are
still required, for example for "connbytes" extension. However, 64bit counters
waste a lot of memory and it was not possible to enable/disable it runtime.
This patch:
- reimplements accounting with respect to the extension infrastructure,
- makes one global version of seq_print_acct() instead of two seq_print_counters(),
- makes it possible to enable it at boot time (for CONFIG_SYSCTL/CONFIG_SYSFS=n),
- makes it possible to enable/disable it at runtime by sysctl or sysfs,
- extends counters from 32bit to 64bit,
- renames ip_conntrack_counter -> nf_conn_counter,
- enables accounting code unconditionally (no longer depends on CONFIG_NF_CT_ACCT),
- set initial accounting enable state based on CONFIG_NF_CT_ACCT
- removes buggy IPCT_COUNTER_FILLING event handling.
If accounting is enabled newly created connections get additional acct extend.
Old connections are not changed as it is not possible to add a ct_extend area
to confirmed conntrack. Accounting is performed for all connections with
acct extend regardless of a current state of "net.netfilter.nf_conntrack_acct".
Signed-off-by: Krzysztof Piotr Oledzki <ole@ans.pl>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-21 19:01:34 +02:00
|
|
|
return false;
|
2005-08-13 22:56:26 +02:00
|
|
|
|
2013-09-26 17:31:51 +02:00
|
|
|
counters = acct->counter;
|
2005-08-13 22:56:26 +02:00
|
|
|
switch (sinfo->what) {
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
case XT_CONNBYTES_PKTS:
|
2005-08-13 22:56:26 +02:00
|
|
|
switch (sinfo->direction) {
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
case XT_CONNBYTES_DIR_ORIGINAL:
|
2011-12-14 14:45:20 +01:00
|
|
|
what = atomic64_read(&counters[IP_CT_DIR_ORIGINAL].packets);
|
2005-08-13 22:56:26 +02:00
|
|
|
break;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
case XT_CONNBYTES_DIR_REPLY:
|
2011-12-14 14:45:20 +01:00
|
|
|
what = atomic64_read(&counters[IP_CT_DIR_REPLY].packets);
|
2005-08-13 22:56:26 +02:00
|
|
|
break;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
case XT_CONNBYTES_DIR_BOTH:
|
2011-12-14 14:45:20 +01:00
|
|
|
what = atomic64_read(&counters[IP_CT_DIR_ORIGINAL].packets);
|
|
|
|
what += atomic64_read(&counters[IP_CT_DIR_REPLY].packets);
|
2005-08-13 22:56:26 +02:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
break;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
case XT_CONNBYTES_BYTES:
|
2005-08-13 22:56:26 +02:00
|
|
|
switch (sinfo->direction) {
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
case XT_CONNBYTES_DIR_ORIGINAL:
|
2011-12-14 14:45:20 +01:00
|
|
|
what = atomic64_read(&counters[IP_CT_DIR_ORIGINAL].bytes);
|
2005-08-13 22:56:26 +02:00
|
|
|
break;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
case XT_CONNBYTES_DIR_REPLY:
|
2011-12-14 14:45:20 +01:00
|
|
|
what = atomic64_read(&counters[IP_CT_DIR_REPLY].bytes);
|
2005-08-13 22:56:26 +02:00
|
|
|
break;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
case XT_CONNBYTES_DIR_BOTH:
|
2011-12-14 14:45:20 +01:00
|
|
|
what = atomic64_read(&counters[IP_CT_DIR_ORIGINAL].bytes);
|
|
|
|
what += atomic64_read(&counters[IP_CT_DIR_REPLY].bytes);
|
2005-08-13 22:56:26 +02:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
break;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
case XT_CONNBYTES_AVGPKT:
|
2005-08-13 22:56:26 +02:00
|
|
|
switch (sinfo->direction) {
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
case XT_CONNBYTES_DIR_ORIGINAL:
|
2011-12-14 14:45:20 +01:00
|
|
|
bytes = atomic64_read(&counters[IP_CT_DIR_ORIGINAL].bytes);
|
|
|
|
pkts = atomic64_read(&counters[IP_CT_DIR_ORIGINAL].packets);
|
2005-08-13 22:56:26 +02:00
|
|
|
break;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
case XT_CONNBYTES_DIR_REPLY:
|
2011-12-14 14:45:20 +01:00
|
|
|
bytes = atomic64_read(&counters[IP_CT_DIR_REPLY].bytes);
|
|
|
|
pkts = atomic64_read(&counters[IP_CT_DIR_REPLY].packets);
|
2005-08-13 22:56:26 +02:00
|
|
|
break;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
case XT_CONNBYTES_DIR_BOTH:
|
2011-12-14 14:45:20 +01:00
|
|
|
bytes = atomic64_read(&counters[IP_CT_DIR_ORIGINAL].bytes) +
|
|
|
|
atomic64_read(&counters[IP_CT_DIR_REPLY].bytes);
|
|
|
|
pkts = atomic64_read(&counters[IP_CT_DIR_ORIGINAL].packets) +
|
|
|
|
atomic64_read(&counters[IP_CT_DIR_REPLY].packets);
|
2005-08-13 22:56:26 +02:00
|
|
|
break;
|
|
|
|
}
|
2007-01-30 23:24:29 +01:00
|
|
|
if (pkts != 0)
|
2008-05-01 13:34:28 +02:00
|
|
|
what = div64_u64(bytes, pkts);
|
2005-08-13 22:56:26 +02:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2011-12-16 18:35:15 +01:00
|
|
|
if (sinfo->count.to >= sinfo->count.from)
|
2007-07-08 07:19:08 +02:00
|
|
|
return what <= sinfo->count.to && what >= sinfo->count.from;
|
2011-12-16 18:35:15 +01:00
|
|
|
else /* inverted */
|
|
|
|
return what < sinfo->count.to || what > sinfo->count.from;
|
2005-08-13 22:56:26 +02:00
|
|
|
}
|
|
|
|
|
2010-03-19 17:16:42 +01:00
|
|
|
static int connbytes_mt_check(const struct xt_mtchk_param *par)
|
2005-08-13 22:56:26 +02:00
|
|
|
{
|
2008-10-08 11:35:18 +02:00
|
|
|
const struct xt_connbytes_info *sinfo = par->matchinfo;
|
2010-03-19 17:32:59 +01:00
|
|
|
int ret;
|
2005-08-13 22:56:26 +02:00
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
if (sinfo->what != XT_CONNBYTES_PKTS &&
|
|
|
|
sinfo->what != XT_CONNBYTES_BYTES &&
|
|
|
|
sinfo->what != XT_CONNBYTES_AVGPKT)
|
2010-03-23 16:35:56 +01:00
|
|
|
return -EINVAL;
|
2005-08-13 22:56:26 +02:00
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
if (sinfo->direction != XT_CONNBYTES_DIR_ORIGINAL &&
|
|
|
|
sinfo->direction != XT_CONNBYTES_DIR_REPLY &&
|
|
|
|
sinfo->direction != XT_CONNBYTES_DIR_BOTH)
|
2010-03-23 16:35:56 +01:00
|
|
|
return -EINVAL;
|
2005-08-13 22:56:26 +02:00
|
|
|
|
2016-11-15 21:36:40 +01:00
|
|
|
ret = nf_ct_netns_get(par->net, par->family);
|
2010-03-21 04:05:56 +01:00
|
|
|
if (ret < 0)
|
2018-02-09 15:52:07 +01:00
|
|
|
pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
|
|
|
|
par->family);
|
2010-06-25 14:44:07 +02:00
|
|
|
|
|
|
|
/*
|
|
|
|
* This filter cannot function correctly unless connection tracking
|
|
|
|
* accounting is enabled, so complain in the hope that someone notices.
|
|
|
|
*/
|
|
|
|
if (!nf_ct_acct_enabled(par->net)) {
|
2014-09-10 06:17:32 +02:00
|
|
|
pr_warn("Forcing CT accounting to be enabled\n");
|
2010-06-25 14:44:07 +02:00
|
|
|
nf_ct_set_acct(par->net, true);
|
|
|
|
}
|
|
|
|
|
2010-03-21 04:05:56 +01:00
|
|
|
return ret;
|
2005-08-13 22:56:26 +02:00
|
|
|
}
|
|
|
|
|
2008-10-08 11:35:19 +02:00
|
|
|
static void connbytes_mt_destroy(const struct xt_mtdtor_param *par)
|
2006-12-12 09:29:02 +01:00
|
|
|
{
|
2016-11-15 21:36:40 +01:00
|
|
|
nf_ct_netns_put(par->net, par->family);
|
2006-12-12 09:29:02 +01:00
|
|
|
}
|
|
|
|
|
2008-10-08 11:35:20 +02:00
|
|
|
static struct xt_match connbytes_mt_reg __read_mostly = {
|
|
|
|
.name = "connbytes",
|
|
|
|
.revision = 0,
|
|
|
|
.family = NFPROTO_UNSPEC,
|
|
|
|
.checkentry = connbytes_mt_check,
|
|
|
|
.match = connbytes_mt,
|
|
|
|
.destroy = connbytes_mt_destroy,
|
|
|
|
.matchsize = sizeof(struct xt_connbytes_info),
|
|
|
|
.me = THIS_MODULE,
|
2005-08-13 22:56:26 +02:00
|
|
|
};
|
|
|
|
|
2007-12-05 08:24:03 +01:00
|
|
|
static int __init connbytes_mt_init(void)
|
2005-08-13 22:56:26 +02:00
|
|
|
{
|
2008-10-08 11:35:20 +02:00
|
|
|
return xt_register_match(&connbytes_mt_reg);
|
2005-08-13 22:56:26 +02:00
|
|
|
}
|
|
|
|
|
2007-12-05 08:24:03 +01:00
|
|
|
static void __exit connbytes_mt_exit(void)
|
2005-08-13 22:56:26 +02:00
|
|
|
{
|
2008-10-08 11:35:20 +02:00
|
|
|
xt_unregister_match(&connbytes_mt_reg);
|
2005-08-13 22:56:26 +02:00
|
|
|
}
|
|
|
|
|
2007-12-05 08:24:03 +01:00
|
|
|
module_init(connbytes_mt_init);
|
|
|
|
module_exit(connbytes_mt_exit);
|