1 /* 2 * (C) 2007 Patrick McHardy <kaber@trash.net> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 */ 8 #include <linux/module.h> 9 #include <linux/skbuff.h> 10 #include <linux/gen_stats.h> 11 12 #include <linux/netfilter/x_tables.h> 13 #include <linux/netfilter/xt_rateest.h> 14 #include <net/netfilter/xt_rateest.h> 15 16 17 static bool xt_rateest_mt(const struct sk_buff *skb, 18 const struct net_device *in, 19 const struct net_device *out, 20 const struct xt_match *match, 21 const void *matchinfo, 22 int offset, 23 unsigned int protoff, 24 bool *hotdrop) 25 { 26 const struct xt_rateest_match_info *info = matchinfo; 27 struct gnet_stats_rate_est *r; 28 u_int32_t bps1, bps2, pps1, pps2; 29 bool ret = true; 30 31 spin_lock_bh(&info->est1->lock); 32 r = &info->est1->rstats; 33 if (info->flags & XT_RATEEST_MATCH_DELTA) { 34 bps1 = info->bps1 >= r->bps ? info->bps1 - r->bps : 0; 35 pps1 = info->pps1 >= r->pps ? info->pps1 - r->pps : 0; 36 } else { 37 bps1 = r->bps; 38 pps1 = r->pps; 39 } 40 spin_unlock_bh(&info->est1->lock); 41 42 if (info->flags & XT_RATEEST_MATCH_ABS) { 43 bps2 = info->bps2; 44 pps2 = info->pps2; 45 } else { 46 spin_lock_bh(&info->est2->lock); 47 r = &info->est2->rstats; 48 if (info->flags & XT_RATEEST_MATCH_DELTA) { 49 bps2 = info->bps2 >= r->bps ? info->bps2 - r->bps : 0; 50 pps2 = info->pps2 >= r->pps ? info->pps2 - r->pps : 0; 51 } else { 52 bps2 = r->bps; 53 pps2 = r->pps; 54 } 55 spin_unlock_bh(&info->est2->lock); 56 } 57 58 switch (info->mode) { 59 case XT_RATEEST_MATCH_LT: 60 if (info->flags & XT_RATEEST_MATCH_BPS) 61 ret &= bps1 < bps2; 62 if (info->flags & XT_RATEEST_MATCH_PPS) 63 ret &= pps1 < pps2; 64 break; 65 case XT_RATEEST_MATCH_GT: 66 if (info->flags & XT_RATEEST_MATCH_BPS) 67 ret &= bps1 > bps2; 68 if (info->flags & XT_RATEEST_MATCH_PPS) 69 ret &= pps1 > pps2; 70 break; 71 case XT_RATEEST_MATCH_EQ: 72 if (info->flags & XT_RATEEST_MATCH_BPS) 73 ret &= bps1 == bps2; 74 if (info->flags & XT_RATEEST_MATCH_PPS) 75 ret &= pps2 == pps2; 76 break; 77 } 78 79 ret ^= info->flags & XT_RATEEST_MATCH_INVERT ? true : false; 80 return ret; 81 } 82 83 static bool xt_rateest_mt_checkentry(const char *tablename, 84 const void *ip, 85 const struct xt_match *match, 86 void *matchinfo, 87 unsigned int hook_mask) 88 { 89 struct xt_rateest_match_info *info = matchinfo; 90 struct xt_rateest *est1, *est2; 91 92 if (hweight32(info->flags & (XT_RATEEST_MATCH_ABS | 93 XT_RATEEST_MATCH_REL)) != 1) 94 goto err1; 95 96 if (!(info->flags & (XT_RATEEST_MATCH_BPS | XT_RATEEST_MATCH_PPS))) 97 goto err1; 98 99 switch (info->mode) { 100 case XT_RATEEST_MATCH_EQ: 101 case XT_RATEEST_MATCH_LT: 102 case XT_RATEEST_MATCH_GT: 103 break; 104 default: 105 goto err1; 106 } 107 108 est1 = xt_rateest_lookup(info->name1); 109 if (!est1) 110 goto err1; 111 112 if (info->flags & XT_RATEEST_MATCH_REL) { 113 est2 = xt_rateest_lookup(info->name2); 114 if (!est2) 115 goto err2; 116 } else 117 est2 = NULL; 118 119 120 info->est1 = est1; 121 info->est2 = est2; 122 return true; 123 124 err2: 125 xt_rateest_put(est1); 126 err1: 127 return false; 128 } 129 130 static void xt_rateest_mt_destroy(const struct xt_match *match, 131 void *matchinfo) 132 { 133 struct xt_rateest_match_info *info = matchinfo; 134 135 xt_rateest_put(info->est1); 136 if (info->est2) 137 xt_rateest_put(info->est2); 138 } 139 140 static struct xt_match xt_rateest_match[] __read_mostly = { 141 { 142 .family = NFPROTO_IPV4, 143 .name = "rateest", 144 .match = xt_rateest_mt, 145 .checkentry = xt_rateest_mt_checkentry, 146 .destroy = xt_rateest_mt_destroy, 147 .matchsize = sizeof(struct xt_rateest_match_info), 148 .me = THIS_MODULE, 149 }, 150 { 151 .family = NFPROTO_IPV6, 152 .name = "rateest", 153 .match = xt_rateest_mt, 154 .checkentry = xt_rateest_mt_checkentry, 155 .destroy = xt_rateest_mt_destroy, 156 .matchsize = sizeof(struct xt_rateest_match_info), 157 .me = THIS_MODULE, 158 }, 159 }; 160 161 static int __init xt_rateest_mt_init(void) 162 { 163 return xt_register_matches(xt_rateest_match, 164 ARRAY_SIZE(xt_rateest_match)); 165 } 166 167 static void __exit xt_rateest_mt_fini(void) 168 { 169 xt_unregister_matches(xt_rateest_match, ARRAY_SIZE(xt_rateest_match)); 170 } 171 172 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 173 MODULE_LICENSE("GPL"); 174 MODULE_DESCRIPTION("xtables rate estimator match"); 175 MODULE_ALIAS("ipt_rateest"); 176 MODULE_ALIAS("ip6t_rateest"); 177 module_init(xt_rateest_mt_init); 178 module_exit(xt_rateest_mt_fini); 179