1 /* 2 * (C) 2007 Patrick McHardy <kaber@trash.net> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 */ 8 #include <linux/module.h> 9 #include <linux/skbuff.h> 10 #include <linux/gen_stats.h> 11 12 #include <linux/netfilter/x_tables.h> 13 #include <linux/netfilter/xt_rateest.h> 14 #include <net/netfilter/xt_rateest.h> 15 16 17 static bool 18 xt_rateest_mt(const struct sk_buff *skb, const struct xt_match_param *par) 19 { 20 const struct xt_rateest_match_info *info = par->matchinfo; 21 struct gnet_stats_rate_est *r; 22 u_int32_t bps1, bps2, pps1, pps2; 23 bool ret = true; 24 25 spin_lock_bh(&info->est1->lock); 26 r = &info->est1->rstats; 27 if (info->flags & XT_RATEEST_MATCH_DELTA) { 28 bps1 = info->bps1 >= r->bps ? info->bps1 - r->bps : 0; 29 pps1 = info->pps1 >= r->pps ? info->pps1 - r->pps : 0; 30 } else { 31 bps1 = r->bps; 32 pps1 = r->pps; 33 } 34 spin_unlock_bh(&info->est1->lock); 35 36 if (info->flags & XT_RATEEST_MATCH_ABS) { 37 bps2 = info->bps2; 38 pps2 = info->pps2; 39 } else { 40 spin_lock_bh(&info->est2->lock); 41 r = &info->est2->rstats; 42 if (info->flags & XT_RATEEST_MATCH_DELTA) { 43 bps2 = info->bps2 >= r->bps ? info->bps2 - r->bps : 0; 44 pps2 = info->pps2 >= r->pps ? info->pps2 - r->pps : 0; 45 } else { 46 bps2 = r->bps; 47 pps2 = r->pps; 48 } 49 spin_unlock_bh(&info->est2->lock); 50 } 51 52 switch (info->mode) { 53 case XT_RATEEST_MATCH_LT: 54 if (info->flags & XT_RATEEST_MATCH_BPS) 55 ret &= bps1 < bps2; 56 if (info->flags & XT_RATEEST_MATCH_PPS) 57 ret &= pps1 < pps2; 58 break; 59 case XT_RATEEST_MATCH_GT: 60 if (info->flags & XT_RATEEST_MATCH_BPS) 61 ret &= bps1 > bps2; 62 if (info->flags & XT_RATEEST_MATCH_PPS) 63 ret &= pps1 > pps2; 64 break; 65 case XT_RATEEST_MATCH_EQ: 66 if (info->flags & XT_RATEEST_MATCH_BPS) 67 ret &= bps1 == bps2; 68 if (info->flags & XT_RATEEST_MATCH_PPS) 69 ret &= pps2 == pps2; 70 break; 71 } 72 73 ret ^= info->flags & XT_RATEEST_MATCH_INVERT ? true : false; 74 return ret; 75 } 76 77 static bool xt_rateest_mt_checkentry(const char *tablename, 78 const void *ip, 79 const struct xt_match *match, 80 void *matchinfo, 81 unsigned int hook_mask) 82 { 83 struct xt_rateest_match_info *info = matchinfo; 84 struct xt_rateest *est1, *est2; 85 86 if (hweight32(info->flags & (XT_RATEEST_MATCH_ABS | 87 XT_RATEEST_MATCH_REL)) != 1) 88 goto err1; 89 90 if (!(info->flags & (XT_RATEEST_MATCH_BPS | XT_RATEEST_MATCH_PPS))) 91 goto err1; 92 93 switch (info->mode) { 94 case XT_RATEEST_MATCH_EQ: 95 case XT_RATEEST_MATCH_LT: 96 case XT_RATEEST_MATCH_GT: 97 break; 98 default: 99 goto err1; 100 } 101 102 est1 = xt_rateest_lookup(info->name1); 103 if (!est1) 104 goto err1; 105 106 if (info->flags & XT_RATEEST_MATCH_REL) { 107 est2 = xt_rateest_lookup(info->name2); 108 if (!est2) 109 goto err2; 110 } else 111 est2 = NULL; 112 113 114 info->est1 = est1; 115 info->est2 = est2; 116 return true; 117 118 err2: 119 xt_rateest_put(est1); 120 err1: 121 return false; 122 } 123 124 static void xt_rateest_mt_destroy(const struct xt_match *match, 125 void *matchinfo) 126 { 127 struct xt_rateest_match_info *info = matchinfo; 128 129 xt_rateest_put(info->est1); 130 if (info->est2) 131 xt_rateest_put(info->est2); 132 } 133 134 static struct xt_match xt_rateest_mt_reg __read_mostly = { 135 .name = "rateest", 136 .revision = 0, 137 .family = NFPROTO_UNSPEC, 138 .match = xt_rateest_mt, 139 .checkentry = xt_rateest_mt_checkentry, 140 .destroy = xt_rateest_mt_destroy, 141 .matchsize = sizeof(struct xt_rateest_match_info), 142 .me = THIS_MODULE, 143 }; 144 145 static int __init xt_rateest_mt_init(void) 146 { 147 return xt_register_match(&xt_rateest_mt_reg); 148 } 149 150 static void __exit xt_rateest_mt_fini(void) 151 { 152 xt_unregister_match(&xt_rateest_mt_reg); 153 } 154 155 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 156 MODULE_LICENSE("GPL"); 157 MODULE_DESCRIPTION("xtables rate estimator match"); 158 MODULE_ALIAS("ipt_rateest"); 159 MODULE_ALIAS("ip6t_rateest"); 160 module_init(xt_rateest_mt_init); 161 module_exit(xt_rateest_mt_fini); 162